This question already has an answer here:
- I am under DDoS. What can I do? 2 answers
I have a mail server, Debian Linux 2.4.31, which is dropping TCP connections and basically being unavailable. I have iptables running on it and its pretty much very restrictive.
When I run "netstat -tanp|wc -l" i get 366 while "cat /proc/net/ip_conntrack | wc -l" gives me 124172 because I had increased /proc/sys/net/ipv4/ip_conntrack_max since I would see "ip_conntrack: table full, dropping packet." in dmesg output, and yes I am still seeing those although I did increase the max.
I would/should enable tcp syn cookies, but for some odd reason the kernel was compiled without it so I can't go forward without recompiling it.
I just wanted to know if these symptoms describe a DDOS so I would go forward in adding tcp_syn_cookies.