I started seeing this odd sort of effect that resembles denial-of-service attack against a Linux server. The effect is that the network becomes at least partially unusable very much the same as what you see with a traditional DOS or DDOS attack.

Here's a trimmed netstat dump from during the "attack" (assuming that's what it is):

Proto Recv-Q Send-Q Local Address  Foreign Address       State       PID
tcp        1      0   CLOSE_WAIT  18482/httpd         
tcp        0      1     LAST_ACK    -                   
tcp        0  18980   ESTABLISHED 18016/nginx: worker 
tcp        0  11709   ESTABLISHED 18016/nginx: worker 
tcp        0  55743     LAST_ACK    -                   
tcp        0      0  ESTABLISHED 16808/httpd         
tcp        0  32814     LAST_ACK    -                   
tcp        0  48029     LAST_ACK    -                   
tcp        1  33581     LAST_ACK    -                   
tcp        0  23582     LAST_ACK    -                   
tcp        0    684   FIN_WAIT1   -                   
tcp        0  37621     LAST_ACK    -                   
tcp        0  18980 ESTABLISHED 18016/nginx: worker 
tcp        0      0  ESTABLISHED 18377/httpd         
tcp        0      0          ESTABLISHED 18379/httpd         
tcp        0    174          ESTABLISHED 18482/httpd         
tcp        0  44538  FIN_WAIT1   -                   
tcp        0  64812   ESTABLISHED 1251/httpd          
tcp        1      0   CLOSE_WAIT  18379/httpd         
tcp        0      1  FIN_WAIT1   -                   
tcp        1  31751    CLOSING     -                   
tcp        0  33396    ESTABLISHED 18016/nginx: worker 

Notice primarily the high usage of Send-Q buffer space by connections that are essentially closed, or partially closed. By keeping these connections open, it appears that an attacker can burn though the allowable send queue and bring traffic largely to a halt. This doesn't appear to be a sophisticated attack, but just a few attackers can apparently bring down a server with minimal traffic.

Does anyone recognize this attack pattern and know how to counter it?


Looks like a kind of resource-exhaustion attack. Would need more data to give a more specific answer but are you able to get isolated packet captures of the attack traffic?

Not sure what you're protecting but do you need to receive many connections from the internet at large? My first attempt at countering would be that you may be able to limit how many connections are being setup - to a reasonable threshold per (host/netrange/etc).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.