1

[Linux - CentOS - Apache - VPS]

Last week my servers came under a SYN Flood attack, my hosting provider took some steps and resolved the issue. One of the things that they did was turn on SYN Cookies. I do know that all the traffic originated in South America.

My question is: Knowing which country that the attack is coming from is it possible to defend against the attack by blocking that country in my .htaccess file? Or does the attack happen on a lower level before the .htaccess is in the picture?

4

Knowing which country that the attack is coming from is it possible to defend against the attack by blocking that country in my .htaccess file?

No.

Or does the attack happen on a higher level before the .htaccess is in the picture?

Yes - SYN floods are essentially attacks on a construction of a connection, all way before Apache gets a chance to know what is going on. Wikipedia describes it nicely.

  • +1 Exactly, apache doesn't care about what's going on below layer 3. – Chopper3 Oct 14 '12 at 16:42
  • If this person is using a script would it help to change the port that the site is served on? – Adam Oct 14 '12 at 16:45
  • 1
    Not really: 1) They are probably attacking a service on a port that can't change (like DNS) to stop you changing port 2) Even if you do change the port, you're going to have to leave something on :80 to redirect your traffic that'd you'd lose (e.g. Google). Lose-lose. – Jay Oct 14 '12 at 16:48
  • One more question: I read that using a nginx as a reverse proxy to mitigate minor DDOS attacks webhostingtalk.com/showthread.php?t=949912 might have some affect, is this worth doing? – Adam Oct 14 '12 at 16:54
  • It won't mitigate this kind of attack, if that's what you're asking. – Jay Oct 14 '12 at 17:23

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.