Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow;

iptables -A INPUT -p tcp --syn -m recent --update --seconds 15 --hitcount 20  --name SYNF -j DROP

It drops more than the rate 20packets/15seconds.

Also I wonder what is the correlation between connection/time rate and web content or browser behavior.

  • I'd say it's a sliding scale, are you counting SYNs from single IPs, or SYNs in general? If it's single, do you mean a legitimate single user IP, or one which is serving as the public IP for a NAT network? – NickW Feb 28 '14 at 12:05
  • Thanks for your comment. I mean legitimate single user IP. I eddied my question. – afelaho Feb 28 '14 at 12:28
  • Measure 'normal' activity, then setup rules based on that measurement, leaving some headroom. – Zoredache Feb 28 '14 at 18:52
  • Run a tcpdump capture for a while. Count syns per user per some time period by IP or whatever. – Zoredache Feb 28 '14 at 19:52

The answer is very subjective. It depends on what you consider as being legitimate.

Compare a very dormant webserver against a very successful website and you'll have different rate limite tolerance.

It depends whether you want to conservatively or aggressively drop connections.

First start by collecting "normal usage" (with tools like cacti, munin, mrtg, collectd, ...) then you'll be able to set the limit with a 10~20% above the normal threshold. Because otherwise you won't know what is a normal situation and an attack (until it is too late).

I'd say that the limit should be low if you don't have a high traffic server, and eventually a bit higher on high performance servers.

  • Hi, separating by conservatively or aggressively is a good point. Do you mean service type or web page content related to the SYN packet rate? Having a high traffic is not related to my question, because it is about a single user IP. – afelaho Feb 28 '14 at 14:21
  • 1
    @afelaho If you have a web site, then a single user might open several connections in parallel in order to download a web page faster. This will be a short burst of SYN packets followed by many seconds or minutes of no SYN packets. – Michael Hampton Feb 28 '14 at 15:48
  • @MichaelHampton When I investigate a user behavior, it exactly happens like you described. I wonder what is the correlation between connection/time rate and web content or browser behavior. – afelaho Feb 28 '14 at 19:58
  • @afelaho That depends on how fast your users consume your content. – Michael Hampton Feb 28 '14 at 20:04
  • @MichaelHampton So you mean it is about the content, not browser? – afelaho Feb 28 '14 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.