0
votes
0answers
265 views

Blocking a TCP Syn Attack

I have recently experienced a TCP Syn attack and since it was from a software like LOIC, it kept happening until I banned the IP Addresses or stopped my system from making output to them. Here is what ...
3
votes
1answer
330 views

problems simulating TCP SYN flood

I'm trying to simulate a TCP SYN flood to tune a web server (planning to deploy on AWS). I setup a 'target' VM, disabled iptables and running hping (hping -p 80 -i u1000 -c 1000 -S destaddr) from ...
1
vote
1answer
98 views

can I filter TCP SYN packets with seq=0

My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs. Packets look like this: IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0 with ...
1
vote
0answers
51 views

Effective ways of mitigating Spoofed Syn Flood with iptables [duplicate]

Possible Duplicate: SYN Flood Advice Heyo, Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them? Syn Cookies are already ...
2
votes
2answers
218 views

What happens if a server never receives the RST packet?

Someone recently decided to show me a POC of a new Denial of Service method using SYN/TCP he's figured out. I thought it was complete nonsense, but after explaining to him about SYN-SYN/ACK-RST, he ...
2
votes
1answer
4k views

SynFlood Attacks : How many packets per Second are possible per Mbit?

i would be greatfull for the exact calculation/formula how to calculate how much SYN packets can be send per 1 Mbit Bandwith: 1.) What is the Size (in Bytes) of one SYN-Packet = 20 Bytes? ...
1
vote
1answer
59 views

how to block packetflood originating from certain network but different IPs

i am receiving massive amount of bogus connections from ttnet.net.tr and their DSL subscribers. what is the best way to deal with it? contact their abuse email? i cannot block the IPs. there are way ...
0
votes
2answers
1k views

Am I under DDOS? [duplicate]

I have a mail server, Debian Linux 2.4.31, which is dropping TCP connections and basically being unavailable. I have iptables running on it and its pretty much very restrictive. When I run "netstat ...