Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [syn]

The tag has no usage guidance.

1
vote
0answers
28 views

One port not responding to SYN packets while other is working fine

We have an app with two used ports. Monitor port is used by load balancer for health checks and in this case connections are successful. The main application port however, is not responding to any ...
2
votes
1answer
35 views

SYN packets never responded to with SYN/ACK

I'm having an issue with a tcp handshake that I can't find the answer to anywhere else. I have a program running on my local device that posts data to port 50000. In a terminal on the same machine, I ...
1
vote
1answer
74 views

Azure Ubuntu VM: Is a connection to 168.63.129.16:80 mandatory for Basic DDOS protection?

Yesterday I noticed some suspicous activity when running netstat | grep http on my Azure Ubuntu VM: There were over 60 lines like this: tcp 0 0 ser:http hosted-by.blazing:...
0
votes
1answer
136 views

Slow SYN flood: preventing SYN amplification?

a (linux) webserver I administer (on a VPS) for a low volume website has just been subjected to about 5 SYN requests/second on port 80, with no other traffic coming from the remote host. It was more ...
0
votes
1answer
46 views

Fallout from apparent dos attack - httpd trying to contact attacker [duplicate]

I have a server running multiple web hosts (all internally managed) which was the subject of what looked like a dos attack last night. I blocked the attacking IP in IPTABLES for both input and output ...
1
vote
1answer
114 views

Possible SYN flooding - Apache & Sphinx listened ports

I’ve been getting this message: possible SYN flooding. I already tweaked the "net.ipv4.tcp_max_syn_backlog" directive, but the issue persists and I cannot determine the reason. To be noted this is ...
-1
votes
1answer
142 views

Run shell script on the event of “possible SYN flooding”

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file. So, is it possible to trigger a script/...
1
vote
1answer
2k views

Handle “possible SYN flooding on port 443. Sending cookies.”

My website constantly has several users online all the time. The server uses Apache/PHP, database and Memcached. On normal use, the application works well and fast. However, the server appears to ...
0
votes
2answers
1k views

Count number of incoming connection on a port - Linux

We have a server which listens on port X. The server has a large number of clients, from time to time the process gets hung, I am seeing SYN flooding messages in the log. I have been trying to tune ...
0
votes
0answers
402 views

“Filtered” port when accessing server

I'm having periodic trouble accessing one of my DigitalOcean servers from Azure machines. I have isolated a test that - I believe - demonstrates the issue and captured a tcpdump from the server for ...
1
vote
0answers
217 views

TCP Syn cookies is it always turned on when enabled?

For Linux kernel 2.6.32 if I set net.ipv4.tcp_syncookies = 1 will that be always used or only during a SYN flood attack? I found 2 sources which says the opposite. 1: "There are, however, two ...
1
vote
1answer
865 views

Multiple syn's packets before handshake?

I have a scenario, I'm analyzing ssl (decrpyt) traffic to my webserver. I'm investigating server and end-to-end delay issues. In between this I'm stuck at following traffic pattern for which I need ...
3
votes
3answers
4k views

better alternative for tcp_syncookies in linux

In an effort to prevent DDOS attacks I followed suggestions to leave /proc/sys/net/ipv4/tcp_syncookies value set to 1 in my linux box to enable TCP syncookies. However, when I look at this URL: http:/...
1
vote
1answer
1k views

TCP syn, ack Lost Before Entering IPsec VPN tunnel

I have configured a site to site VPN which is working fine as traffic is going through the tunnel. I am able to ping and Telnet hosts on the other network and they are able to ping me back. The ...
1
vote
1answer
453 views

No response to TCP SYN packet when padding is not 0's or F's

I have this client which initiates a 3 way handshake with a SYN packet but there is no SYN ACK response. We figured out that it was because the client did not pad the end of the TCP headers with 0's ...
1
vote
0answers
638 views

How to block hping3 SYN ACK efficiently with iptables?

I'm trying to execute a TCP SYN flood on my Debian web server with nginx. Executing tcpdump "tcp[tcpflags] & (tcp-syn) != 0" while flooding, I see all packets coming. iptables seem to work well ...
0
votes
1answer
103 views

Windows Server 2008 sending regular TCP DNS requests to Forwarders

Our organization's primary DNS server is a Windows Server 2008 which two Forwarders set. I happened to notice on our firewall that this server is sending out regular TCP requests to the Forwarders in ...
1
vote
1answer
792 views

No SYN/ACK answer from server

At first I describe my LAN organization. I have 2 Networks (scheme http://take.ms/s3CSy): 192.168.0.0 / 255.255.255.0, router ASUS RT-N65U with internal IP 192.168.0.1, static external IP without NAT:...
0
votes
1answer
257 views

Enabling syncookies in /proc not working

I'm trying to enable syncookies by echoing '1' in de /proc file like this: echo 1 > /proc/sys/net/ipv4/tcp_syncookies (I also tried it with quotes, without whitespace "1>/proc...") However after ...
4
votes
0answers
2k views

TCP connection stuck in SYN_RECV state despite ACK received

My client and server are both internal machines. tcpdump on both client and server show all three parts of handshake are communicated, however netstat on server shows SYN_RECV, and on client shows ...
1
vote
1answer
5k views

How to ban Syn Flood Attacks using Fail2Ban?

In my log, I am frequently seeing dropped ips like this: > Oct 30 17:32:24 IPTables Dropped: IN=eth0 OUT= > MAC=04:01:2b:bd:b0:01:4c:96:14:ff:df:f0:08:00 SRC=62.210.94.116 > DST=128.199.xxx....
0
votes
1answer
1k views

Google Computer Engine Firewall and IpTables

I am very new to to server administration and just discovered that I can use Google Compute Engine to host my website similar to way it works with Linode or Digital Ocean. I am unsure on the following ...
2
votes
1answer
7k views

Linux iptables - reject tcp SYN with RST

I am doing an implementation on a linux machine to reject incoming telnet requests from wan side telnet port 8023. The functionality is achieved by using the below iptables rules. The first rule in ...
5
votes
1answer
21k views

every minute - possible SYN flooding on port 80

On our Linux server from time to time we get well known SYN flood message: possible SYN flooding on port 80 this is probably not an attack because website traffic is big. However from some time ...
0
votes
1answer
212 views

Interpreting ** RABHIT ** logs - Potential Attak - SYN?

I am hosting a web on a Linux - Debian Wheezy x64. Our Web Server is LiteSpeed using APF-Firewall and DDoS-Defeat Recently, we are getting logs of below sort, telling us it may be a potential attack ...
1
vote
2answers
662 views

Incoming TCP SYNs possibilities

This might be a general TCP question. Can I receive TCP SYN packet on an ESTABLISHED connection OR a connection in TIME-WAIT state? Is this possible?
4
votes
2answers
2k views

98% cpu usage on ubuntu server running apache, site is unresponsive

I run a server with apache2 on an ubuntu box. It is a crypto mining pool. Everything was running normal even with the large inflow of people accessing our site. Then out of nowhere our cpu usage ...
9
votes
1answer
2k views

No response to some SYN packets when timestamps are enabled

I have a TCP server listening on a machine ("the server") running Ubuntu 12.04.3 (kernel 3.8.0-31-generic). It receives connections from 2 different client machines. Machine A is running Ubuntu 12.04....
0
votes
1answer
150 views

What is maximum legitimate SYN traffic rate

Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow; ...
4
votes
1answer
2k views

problems simulating TCP SYN flood

I'm trying to simulate a TCP SYN flood to tune a web server (planning to deploy on AWS). I setup a 'target' VM, disabled iptables and running hping (hping -p 80 -i u1000 -c 1000 -S destaddr) from ...