Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a usable state. The server load was low during the attack, so it didn't bring the server down, it just timed out HTTP visitors.

Now I don't believe these solved the issue, but they certainly resolved the symptons until the flood subsided.

  • Set *sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv=5*

  • Increased Apache prefork ServerLimit and MaxClient to 512 (from 256).

  • Set Apache ListenBackLog to 1024

I saw various iptables --limit options being discussed elsewhere on the web, however we concluded that these would limit legitimate traffic, as each item of the webpage being requested (each image etc) would count towards this limit, stopping the page from loading fully.

What do people do in these situations, and were our action wise since load wasn't an issue?

share|improve this question

2 Answers 2

Since I am not an expert in iptables, I generally let one of two firewalls handle this for me. Both APF and CSF are great firewalls when it comes to protection from SYN attacks, as well as a multitude of other ways folks can attack your server.

I do not know your specific configuration, but I have used both of the said firewalls on "general" cPanel/DirectAdmin/Plesk servers as well as some with custom services and it works great once you allow the right ports.

Separately, you may wish to turn on SYN Cookies, which helps mitigate attacks where SYN is left open. Both of the above scripts have this as an option.

share|improve this answer
1  
Any suggestion on APF vs. CSF ? +1 for your suggestion anyway –  AlberT Sep 29 '09 at 17:30
    
I've used APF on many servers in the past, but CSF seems to be better developed now and has some features APF is lacking in the non-firewall, overall security of the server. If you are looking for a simple firewall APF will work well, but if you are looking for a "package" then go with CSF. –  Dave Drager Sep 29 '09 at 17:35
    
On the matter of SYN cookies - we checked and they were switched on, but we still had to take the steps above to get the site responding again. I'll have a look at those firewalls you mention, as I'm familiar with IPtables but not the advanced usage of it. –  Coops Sep 30 '09 at 10:39

I would use a firewall at the network perimeter to prevent\remediate SYN flood attacks (as well as DOS, DDOS, spoofing, port probes, address space probes, etc.). I don't want this type of stuff getting into my internal network, where I'll have to deal with it on a machine by machine basis.

share|improve this answer
    
Agreed. In this case I was left to handle it on the server as the network config couldn't be adapted in time. –  Coops Sep 30 '09 at 8:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.