My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.
Packets look like this:
IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0
with p.q.r.s
apparently being random. (yes, source port is always 1234)
While this alone is not enough to fill my link, the responses play their part as well and the machines becomes pretty slow.
Is it reasonable to drop TCP SYNs with seq=0?
1234
? We saw a DDoS with exactly the same characteristics and that worked for us. The same DDoS had randomised ports earlier so it may not be a permanent solution.