For the last two days I am facing a syn flood attack and continue to get following messages:

Oct 27 00:52:58 server2 kernel: [ 1356.539680] possible SYN flooding on port 80. Sending cookies.
Oct 27 00:53:58 server2 kernel: [ 1416.545865] possible SYN flooding on port 80. Sending cookies.
Oct 27 00:54:58 server2 kernel: [ 1476.546692] possible SYN flooding on port 80. Sending cookies.
Oct 27 00:55:58 server2 kernel: [ 1536.547742] possible SYN flooding on port 80. Sending cookies.
Oct 27 00:56:58 server2 kernel: [ 1596.549753] possible SYN flooding on port 80. Sending cookies.

At this time sites are not loading.

I am on CentOS Linux and I have tried the following :

sysctl -w net.ipv4.tcp_syncookies=1
echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle

closed as unclear what you're asking by Tero Kilkanen, MadHatter, yoonix, rnxrx, womble Dec 5 '16 at 0:13

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

you should make these change too On Linux, those are some settings you can use to enable and set up SYN Cookies efficiently:

echo 1 > /proc/sys/net/ipv4/tcp_syncookies
echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
echo 3 > /proc/sys/net/ipv4/tcp_synack_retries

To make those settings load automatically on startup, add those lines to the file /etc/sysctl.conf:

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_synack_retries = 3
  • i made above changes Still getting same problem ,it happening to a particular account . netstat -tuna | grep :80 | grep SYN_RECV this results shows results from our server ip. when null routed this ip syn flood problem stopped, when i removed again started – max Oct 27 '16 at 12:16
  • Just to get a better idea, how much SYN_RECV per second do you see? Are them from different IP's or most come from the same? – Fredi Oct 27 '16 at 15:37
  • it nearly comes to 100 and we enabled cloud flare free account so all this shows cloud flare ip(different IPs i think so) – max Oct 27 '16 at 16:29

Not the answer you're looking for? Browse other questions tagged or ask your own question.