-1

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file.

So, is it possible to trigger a script/command when the kernel alerts for "possible SYN flooding on port XXX" ?

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

2

In short: yes!

But that depends a bit in the syslog daemon you're running.

Syslog-ng allows that with the program() destination.

Rsyslog offers actions.

  • Thank you very much. I have succeeded in running a script on the event of SYN Flooding. I use "rsyslog". Very kind regards! – Nuno Jul 2 '16 at 8:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.