2

I have read an article (not in English) on how to protect a server against SYN flood attacks by modifying some directives in sysctl.conf. That article has a sentence like: "it's possible to recompile kernel with some options to improve protection against the SYN flood". I'm sorry if my question is too general but could you point out to me which kernel options it may be referring to? I downloaded the kernel and looked through all network options with make menuconfig but have not found or missed those options. Googling also didn't help.

Thank you.

Improve this question

2 Answers 2

Reset to default
5

Yes, it is possible to re-compile the kernel with the protections for the Syn Flood attacks, but I don't see a reason for the same.

You need to re-compile the kernel in systems which don't have the capability to change kernel parameters by commands. But if you still want to do that, then you need to change the C code in the kernel.

For example, in Digital Unix, you change the two parameters in header files and then rebuild the operating system. In /usr/sys/include/sys/socket.h, change the SOMAXCONN definition so the 8 becomes 1024.

In /usr/sys/include/netinet/tcp_timer.h change the TCPTV_KEEP_INIT definition from 75*PR_SLOWHZ to 25*PR_SLOWHZ.

Then rebuild the kernel using Digital Unix procedures, which are unique to this Unix version.

You can also rebuild the kernel changing these same two parameters with Berkeley-derived Unix system.

However, they're found in different locations, namely /usr/src/sys/netinet/tcp_timer.h and /usr/src/sys/sys/socket.h.

After reading this, if you feel that you don't need to re-compile the kernel then use the following options to mitigate the syn flood attacks.

# echo 1 > /proc/sys/net/ipv4/tcp_syncookies
# echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
# echo 3 > /proc/sys/net/ipv4/tcp_synack_retries

To make the changes persistent across reboots, put these entries into /etc/sysctl.conf file

# TCP SYN Flood Protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3

You can read more details about these at these URLs:

Hope this answers your question. Feel free to comment if you need more clarifications.

Improve this answer
4
  • Digital Unix? Is it even relevant? Question is definitely about Linux and judging by file names Tru64 has a BSD derivative TCP/IP stack.
    – SaveTheRbtz
    Dec 21, 2012 at 23:29
  • Well, I am not sure if you have read my complete answer but I just gave an example here for the OS's where you can't change kernel parameters and you need to re-compile the kernel to change the settings.
    – Napster_X
    Dec 22, 2012 at 2:13
  • You could just give an example of some Linux compile-time tunables (i.e. some of them gist.github.com/2407652) it would be more relevant.
    – SaveTheRbtz
    Dec 22, 2012 at 6:34
  • I wrote something which I thought was the right way to explain the scenario to Andrew. If you feel that there is something which needs to be changed/improved in my answer, please feel free to edit my answer.
    – Napster_X
    Dec 22, 2012 at 6:55
2

Not sure about you're article but the common way for syn flood protection is to set /proc/sys/net/ipv4/tcp_syncookies.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .