1

I have a piece of python code as follow

s = socket.socket()
s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
s.bind((IP, PORT))
s.listen(256)
while True:
    revdata = ""
    try:
       c, addr = s.accept()
       t = threading.Thread(target=handletcp, args=(c,addr))
       t.start()
    except socket.error as exc:
        log("Error: " + str(exc))
s.close()

Currently, my server, which handles 64 IPs, usually gets SYN flood attack. The python service has maximum ~200 TCP connections normally. I want to detect SYN flood attack and suspend the service within python code. Any idea of how to do that efficiently?

Thanks in advance!

Improve this question

1 Answer 1

Reset to default
1

A SYN flood attack is not visible at the level of normal TCP sockets. accept only returns if the TCP handshake is done - which is exactly not the case with SYN floods.

Improve this answer
3
  • thanks! Now I'm monitoring RAM/CPU usage inside the python code to know when I should stop the service. Is that good enough?
    – dk1111
    Jun 20, 2020 at 17:23
  • @dk1111: I'm not sure if your fundamental idea of suspending the service on SYN flood attacks is the right approach in the first place. Usually there are better ways like SYN cookies to deal with the attack. As for monitoring RAM/CPU - this might also cause your service to suspend itself for other reasons than just SYN floods.
    – Steffen Ullrich
    Jun 20, 2020 at 18:10
  • yeah, I have some other failover servers and apparently the attackers don't have enough resources to attack all of my servers, so it's fine for suspending the service for a few hours. I've tried setting syncookies but it seems not helping the situation, I'm using ubuntu 18.04
    – dk1111
    Jun 20, 2020 at 19:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .