0

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow;

iptables -A INPUT -p tcp --syn -m recent --update --seconds 15 --hitcount 20  --name SYNF -j DROP

It drops more than the rate 20packets/15seconds.

Also I wonder what is the correlation between connection/time rate and web content or browser behavior.

4
  • I'd say it's a sliding scale, are you counting SYNs from single IPs, or SYNs in general? If it's single, do you mean a legitimate single user IP, or one which is serving as the public IP for a NAT network?
    – NickW
    Feb 28, 2014 at 12:05
  • Thanks for your comment. I mean legitimate single user IP. I eddied my question.
    – afelaho
    Feb 28, 2014 at 12:28
  • Measure 'normal' activity, then setup rules based on that measurement, leaving some headroom.
    – Zoredache
    Feb 28, 2014 at 18:52
  • Run a tcpdump capture for a while. Count syns per user per some time period by IP or whatever.
    – Zoredache
    Feb 28, 2014 at 19:52

1 Answer 1

1

The answer is very subjective. It depends on what you consider as being legitimate.

Compare a very dormant webserver against a very successful website and you'll have different rate limite tolerance.

It depends whether you want to conservatively or aggressively drop connections.

First start by collecting "normal usage" (with tools like cacti, munin, mrtg, collectd, ...) then you'll be able to set the limit with a 10~20% above the normal threshold. Because otherwise you won't know what is a normal situation and an attack (until it is too late).

I'd say that the limit should be low if you don't have a high traffic server, and eventually a bit higher on high performance servers.

6
  • Hi, separating by conservatively or aggressively is a good point. Do you mean service type or web page content related to the SYN packet rate? Having a high traffic is not related to my question, because it is about a single user IP.
    – afelaho
    Feb 28, 2014 at 14:21
  • 1
    @afelaho If you have a web site, then a single user might open several connections in parallel in order to download a web page faster. This will be a short burst of SYN packets followed by many seconds or minutes of no SYN packets. Feb 28, 2014 at 15:48
  • @MichaelHampton When I investigate a user behavior, it exactly happens like you described. I wonder what is the correlation between connection/time rate and web content or browser behavior.
    – afelaho
    Feb 28, 2014 at 19:58
  • @afelaho That depends on how fast your users consume your content. Feb 28, 2014 at 20:04
  • @MichaelHampton So you mean it is about the content, not browser?
    – afelaho
    Feb 28, 2014 at 20:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .