Questions tagged [syn]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
95 views

Issue moving Ubuntu/Apache webserver from Comcast to AT&T router

I've hosted a simple Ubuntu web server for years on port 443 via a Comcast router with port forwarding enabled without issue. I now have to change to AT&T, the router they provided is a BGW320, ...
PortForwardingQuestion's user avatar
0 votes
0 answers
64 views

How can nft block excessive 443 access?

I'm having a hard time configuring nft to fight floods on 443/TCP. I gave up on iptables and module recent, and now I'm testing nft with its man page sample code, as a lab. So, I'm sending all source ...
Gilberto Martins's user avatar
0 votes
1 answer
246 views

How do I block outgoing SYN packets on my Ubuntu 18 server?

I have an Ubuntu 18 server which is being used as a VPN server ( V2RAY ) . My VPS provider ( OVH ) has sent me this abuse report : 2022.10.22 12:40:47 CEST 51.91.11.***:53258 8.8.8.8:443 TCP SYN 60 ...
Mr Pro's user avatar
  • 33
0 votes
0 answers
252 views

FTP accessible on LAN, but not to port forwarded WAN on public IP address

I have been dealing with this issue a number of different times now, and each time I work on it I can not determine a solution. I have searched these forums, my firewall forums and worked with a few ...
VEnArdoP's user avatar
0 votes
2 answers
671 views

How to detect an intranet SYN flood?

I got this problem: whenever I plug a Linux-server into the intranet, the whole network slows down and then die. Every ping/ssh connection between the intranet yields time out. I unplugged it, then ...
EyeQ Tech's user avatar
  • 131
0 votes
2 answers
2k views

Continuous RST, ACK flags from the same source

Can anyone help me better understand what is going on here? I keep receiving "broken pipe" errors that say the connection is being reset by the peer. Also, I thought 192.168.114.30 was the ...
Jonny Hoffman's user avatar
0 votes
1 answer
815 views

Apache on Debian : server flooded by a lot of 400 , how to protect from it?

My HTTPS server has been experiencing slowness for a few days, so I consulted the log file (the access.log, I use apache2). And I found out that my server is flooded by a lots of 400 : If I change ...
spacecodeur's user avatar
0 votes
0 answers
333 views

netcat no reaction to syn packet crafted with gopacket

I want to do some experiments with TCP packets. Therefore I am using the gopacket (v1.1.19) to craft packets and send them onto an interface. I have this code for creating a SYN packet and putting it ...
jonathan-dev's user avatar
2 votes
1 answer
316 views

IPTABLES - block IPs that do not complete handshake/visit webpage

i am trying to figure out how to achieve something am not sure is achievable and need help. I did my research but couldnt find credible information. Hope this question is not duplicate. SET UP: I am ...
baboon's user avatar
  • 21
3 votes
1 answer
634 views

DDOS manual mitigation using command netstat. How to determine real attackers?

When my server is slow, I have been told to run this command and check if someone is making a request of SYN_RECV to slow down my server: netstat -npt | grep SYN_RECV | awk '{print $5}' | grep -Eo '(...
Kalib Zen's user avatar
  • 137
1 vote
1 answer
1k views

Block SYN,ACK response with iptables

I have a virtual environment and Iam making a SYN flood attack to a Ubuntu Server's port 53 using Kali 2020. I realized that a countermeasure for this attack is to limit or block the responses to the ...
user568948's user avatar
0 votes
1 answer
248 views

Using different rate than the default 1/second in iptables

This code does its job perfectly in limiting syn connections but in line 4 instead of 1/s i need it to be 1/5 seconds, it's an assignment i'm working on that needs to protect against syn-flood attacks ...
sylvain's user avatar
4 votes
3 answers
5k views

Lots of connections in SYN_RECV, not a SYN flood, is it some reflection attack?

Since at least a few months, issuing a netstat -t command on our web server, which has TCP ports 22, 80 and 443 exposed to the Internet, often reveals dozens of connections in SYN_RECV status: $ ...
Ale's user avatar
  • 1,723
1 vote
0 answers
1k views

SYNPROXY doesn't seem to be running

I have attempted to create iptables rules to prevent my server connections limit to be filled up with in-completed SYN packets for which no ACK packet is returned by the client (SYN flood attack). I ...
I'm Root James's user avatar
0 votes
1 answer
491 views

iptables ... -j DROP appears to leave connections open?

So forgive me if this is a dumb question, I'm not much of a networking expert. A friends server is being flooded by a certain IP, which is pretty obvious when looking at the output of tcptrace, as ...
DarkWiiPlayer's user avatar
2 votes
1 answer
2k views

SYN packets never responded to with SYN/ACK

I'm having an issue with a tcp handshake that I can't find the answer to anywhere else. I have a program running on my local device that posts data to port 50000. In a terminal on the same machine, I ...
Austin's user avatar
  • 141
1 vote
1 answer
1k views

Azure Ubuntu VM: Is a connection to 168.63.129.16:80 mandatory for Basic DDOS protection?

Yesterday I noticed some suspicous activity when running netstat | grep http on my Azure Ubuntu VM: There were over 60 lines like this: tcp 0 0 ser:http hosted-by.blazing:...
v25's user avatar
  • 782
1 vote
1 answer
1k views

Slow SYN flood: preventing SYN amplification?

a (linux) webserver I administer (on a VPS) for a low volume website has just been subjected to about 5 SYN requests/second on port 80, with no other traffic coming from the remote host. It was more ...
somloigaluska's user avatar
0 votes
1 answer
58 views

Fallout from apparent dos attack - httpd trying to contact attacker [duplicate]

I have a server running multiple web hosts (all internally managed) which was the subject of what looked like a dos attack last night. I blocked the attacking IP in IPTABLES for both input and output ...
Bob Howlett's user avatar
1 vote
1 answer
226 views

Possible SYN flooding - Apache & Sphinx listened ports

I’ve been getting this message: possible SYN flooding. I already tweaked the "net.ipv4.tcp_max_syn_backlog" directive, but the issue persists and I cannot determine the reason. To be noted this is ...
Thor's user avatar
  • 11
9 votes
2 answers
19k views

tcpdump capture new connections only

I am using tcpdump to capture traffic from specific IP address. Is there the possibility to capture new connections only, meaning TCP streams that start with SYN packet?
Ania Katzenelson's user avatar
-1 votes
1 answer
297 views

Run shell script on the event of "possible SYN flooding"

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file. So, is it possible to trigger a script/...
Nuno's user avatar
  • 633
2 votes
1 answer
8k views

Handle "possible SYN flooding on port 443. Sending cookies."

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
Nuno's user avatar
  • 633
0 votes
2 answers
6k views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
Sridhar Chidurala's user avatar
0 votes
0 answers
603 views

"Filtered" port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
Charles Offenbacher's user avatar
3 votes
1 answer
2k views

TCP SYN cookies are always turned on when enabled?

For Linux kernel 2.6.32 if I set net.ipv4.tcp_syncookies = 1 will that be always used or only during a SYN flood attack? I found 2 sources which say the opposite. 1: "There are, however, two ...
defiler's user avatar
  • 31
1 vote
1 answer
2k views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
asad's user avatar
  • 11
3 votes
3 answers
13k views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: http:/...
user avatar
1 vote
1 answer
3k views

TCP syn, ack Lost Before Entering IPsec VPN tunnel

I have configured a site to site VPN which is working fine as traffic is going through the tunnel. I am able to ping and Telnet hosts on the other network and they are able to ping me back. The ...
Mundeez's user avatar
  • 11
1 vote
1 answer
787 views

No response to TCP SYN packet when padding is not 0's or F's

I have this client which initiates a 3 way handshake with a SYN packet but there is no SYN ACK response. We figured out that it was because the client did not pad the end of the TCP headers with 0's ...
yan bellavance's user avatar
1 vote
0 answers
1k views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
Franzz's user avatar
  • 11
0 votes
1 answer
171 views

Windows Server 2008 sending regular TCP DNS requests to Forwarders

Our organization's primary DNS server is a Windows Server 2008 which two Forwarders set. I happened to notice on our firewall that this server is sending out regular TCP requests to the Forwarders in ...
Andrew S's user avatar
  • 508
1 vote
1 answer
2k views

No SYN/ACK answer from server

At first I describe my LAN organization. I have 2 Networks (scheme http://take.ms/s3CSy): 192.168.0.0 / 255.255.255.0, router ASUS RT-N65U with internal IP 192.168.0.1, static external IP without NAT:...
Aydar's user avatar
  • 41
1 vote
1 answer
1k views

Enabling syncookies in /proc not working

I'm trying to enable syncookies by echoing '1' in de /proc file like this: echo 1 > /proc/sys/net/ipv4/tcp_syncookies (I also tried it with quotes, without whitespace "1>/proc...") However after ...
Sam Hendrickx's user avatar
4 votes
0 answers
3k views

TCP connection stuck in SYN_RECV state despite ACK received

My client and server are both internal machines. tcpdump on both client and server show all three parts of handshake are communicated, however netstat on server shows SYN_RECV, and on client shows ...
Michael Yoon's user avatar
5 votes
3 answers
12k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > DST=128.199.xxx....
Neel's user avatar
  • 1,471
1 vote
1 answer
3k views

Google Computer Engine Firewall and IpTables

I am very new to to server administration and just discovered that I can use Google Compute Engine to host my website similar to way it works with Linode or Digital Ocean. I am unsure on the following ...
Neel's user avatar
  • 1,471
4 votes
1 answer
14k views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
UserM's user avatar
  • 163
5 votes
1 answer
27k views

every minute - possible SYN flooding on port 80

On our Linux server from time to time we get well known SYN flood message: possible SYN flooding on port 80 this is probably not an attack because website traffic is big. However from some time ...
Nick's user avatar
  • 852
0 votes
1 answer
237 views

Interpreting ** RABHIT ** logs - Potential Attak - SYN?

I am hosting a web on a Linux - Debian Wheezy x64. Our Web Server is LiteSpeed using APF-Firewall and DDoS-Defeat Recently, we are getting logs of below sort, telling us it may be a potential attack ...
Yokoshima Fukuma's user avatar
1 vote
2 answers
2k views

Incoming TCP SYNs possibilities

This might be a general TCP question. Can I receive TCP SYN packet on an ESTABLISHED connection OR a connection in TIME-WAIT state? Is this possible?
hari's user avatar
  • 270
4 votes
2 answers
3k views

98% cpu usage on ubuntu server running apache, site is unresponsive

I run a server with apache2 on an ubuntu box. It is a crypto mining pool. Everything was running normal even with the large inflow of people accessing our site. Then out of nowhere our cpu usage ...
user3491412's user avatar
9 votes
1 answer
5k views

No response to some SYN packets when timestamps are enabled

I have a TCP server listening on a machine ("the server") running Ubuntu 12.04.3 (kernel 3.8.0-31-generic). It receives connections from 2 different client machines. Machine A is running Ubuntu 12.04....
user133831's user avatar
0 votes
1 answer
335 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
afelaho's user avatar
  • 101
4 votes
1 answer
3k views

problems simulating TCP SYN flood

I'm trying to simulate a TCP SYN flood to tune a web server (planning to deploy on AWS). I setup a 'target' VM, disabled iptables and running hping (hping -p 80 -i u1000 -c 1000 -S destaddr) from ...
Alex I's user avatar
  • 81