1

My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.

Packets look like this:

IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0

with p.q.r.s apparently being random. (yes, source port is always 1234)

While this alone is not enough to fill my link, the responses play their part as well and the machines becomes pretty slow.

Is it reasonable to drop TCP SYNs with seq=0?

  • 1
    Why not drop when the source port is 1234? We saw a DDoS with exactly the same characteristics and that worked for us. The same DDoS had randomised ports earlier so it may not be a permanent solution. – Ladadadada Jun 9 '13 at 14:54
  • That's what I'm doing right now. I figured, though, it would lead to more false positives and (for some reason) assumed the DDoSer's tool would probably allow him to change the port but not the seqno... – afflux Jun 10 '13 at 16:55
3

Sure, you can drop TCP SYNs with seq=0, you'll only have a 1/4294967296 chance (more or less) or dropping a real connection.... BUT:

The actual TCP sequence number is probably not 0!

I don't know what tool you're using (the output format does not quite seem to match either tcpdump or tshark/Wireshark) but both tcpdump and Wireshark actually remember state of TCP streams and subtract the initial sequence number from the value displayed in both seq and ack fields, so that 0 means "whatever the ISN was".

Note this option from the tcpdump manpage:

   -S     Print absolute, rather than relative, TCP sequence numbers.
| improve this answer | |
  • Oh, right. Sorry, forgot to mention: this was tcpdump and every other connection had non-zero seqnos, so I assumed it was giving absolutes. Will investigate as soon as I get another attack, thank you! – afflux Jun 10 '13 at 16:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.