i would be greatfull for the exact calculation/formula how to calculate how much SYN packets can be send per 1 Mbit Bandwith:

1.) What is the Size (in Bytes) of one SYN-Packet = 20 Bytes? http://de.wikipedia.org/w/index.php?title=Datei:TCP_Header.svg&filetimestamp=20070706210301 Is it correct that the first FIVE lines, heach have 4 Bytes = 20 Bytes in Total? Is it furthermore correct, that there needs to be no payload and a packet only containing a header is valid?

2.) Is it valid to divide 1Mbit / Number-of-Bytes-per-Syn to get a valid result? (1000 000 /8/20 ==>6250 SYN's per Second???)

3.) Or are there other limiting factors that will reduce drastically the number of SYN packets per 1Mbit? (so the calculated number will in practice be much lower.) What would this be that limits this number?

4.) Are there any "must know" tools to protect my server from Syn Attacks (linux/debian). I have implemented some basic stuff in iptables but dont know if this will really help... Better would be filtering on "Frontend/Gateway" Servers? What commercerial Products offer SYN-Flood Filtering, I would be thankfull if you can name some concrete products.

Thanks Jan

  1. your assumption is correct in that a SYN packet does not have to carry any payload and to be strict even does not have to have any options, thus having only the TCP header. But the packet size would not amount to 20 bytes as TCP will be embedded in an IP packet, adding at least 20 more header bytes. Any real-world-SYN would further have options for the MSS, the timestamp value and an ECR value set, resulting a typical size of around 60 bytes per packet. You can use tcpdump to take a look into the traffic, if interested: tcpdump -v -n -p tcp and 'tcp[13] & 2 == 2'
  2. Not quite - you will have to take additional protocol overhead into account (size of the header and checksum of your data link layer - Ethernet will typically add another 31 bytes for example)
  3. SYN cookies and TCP Cookie Transactions have proven to be an effective mechanism against SYN flood attacks. Implementing SYN rate limiting if your clients would not support TCPCT and suffer from the limitations that SYN cookies bring with them will just create another DoS attack vector and is not advisable.
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.