Possible Duplicate:
SYN Flood Advice


Been dealing alot with spoofed syn floods lately. Are there any tips or tricks we could do to better survive them?

Syn Cookies are already enabled.

Is there anything I could do on a TCP level? the attack itself is only ~100mbs but can eat through the CPU.

My ideas: Dropping syn packets that are not in a certain size range (what range?) Modifying some linux networking variables (window scaling?)

....and thats it. Is there any common ways to catch "most" spoofed syn floods, or any tips and tricks to make them more survivable?

marked as duplicate by Michael Hampton, mulaz, rnxrx, Ward, Hubert Kario Oct 6 '12 at 14:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • not duplicate. spoofed syn very different than syn only – Mr Tired Sep 26 '12 at 19:29
  • They're all spoofed. – Michael Hampton Sep 27 '12 at 1:30
  • Sorry, that is incorrect (obviously- a syn packet is the first part of a tcp connection and if every request was spoofed nobody would get a response). A Spoofed Syn is different than unspoofed syn. If you have more questions please google "spoofed vs unspoofed" and it should show you some good data on how TCP connections work. – Mr Tired Sep 27 '12 at 4:22