Today I've been dealing with a server suffering from what looked like a SYN flood attack. It was a bit of a rush to get the site back online, so we did these three steps to bring the service back to a usable state. The server load was low during the attack, so it didn't bring the server down, it just timed out HTTP visitors.

Now I don't believe these solved the issue, but they certainly resolved the symptons until the flood subsided.

  • Set sysctl -w net.ipv4.netfilter.ip_conntrack_tcp_timeout_syn_recv=5

  • Increased Apache prefork ServerLimit and MaxClient to 512 (from 256).

  • Set Apache ListenBackLog to 1024

I saw various iptables --limit options being discussed elsewhere on the web, however we concluded that these would limit legitimate traffic, as each item of the webpage being requested (each image etc) would count towards this limit, stopping the page from loading fully.

What do people do in these situations, and were our action wise since load wasn't an issue?


Since I am not an expert in iptables, I generally let one of two firewalls handle this for me. Both APF and CSF are great firewalls when it comes to protection from SYN attacks, as well as a multitude of other ways folks can attack your server.

I do not know your specific configuration, but I have used both of the said firewalls on "general" cPanel/DirectAdmin/Plesk servers as well as some with custom services and it works great once you allow the right ports.

Separately, you may wish to turn on SYN Cookies, which helps mitigate attacks where SYN is left open. Both of the above scripts have this as an option.

  • 1
    Any suggestion on APF vs. CSF ? +1 for your suggestion anyway – drAlberT Sep 29 '09 at 17:30
  • I've used APF on many servers in the past, but CSF seems to be better developed now and has some features APF is lacking in the non-firewall, overall security of the server. If you are looking for a simple firewall APF will work well, but if you are looking for a "package" then go with CSF. – Dave Drager Sep 29 '09 at 17:35
  • On the matter of SYN cookies - we checked and they were switched on, but we still had to take the steps above to get the site responding again. I'll have a look at those firewalls you mention, as I'm familiar with IPtables but not the advanced usage of it. – Coops Sep 30 '09 at 10:39

I would use a firewall at the network perimeter to prevent\remediate SYN flood attacks (as well as DOS, DDOS, spoofing, port probes, address space probes, etc.). I don't want this type of stuff getting into my internal network, where I'll have to deal with it on a machine by machine basis.

  • Agreed. In this case I was left to handle it on the server as the network config couldn't be adapted in time. – Coops Sep 30 '09 at 8:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.