Syn Attack Defense in Linux

If Linux System You can enter

Netstat-An grep-I"ServerIP Address: 80 "awk'' {print} ''sort uniq-C sort-n

Netstat-An grep "syn" WC-l

This command willAutomaticCount the number of TCP connections in various States. If syn_recv is high, the possibility of TCP-based DDoS attacks cannot be ruled out. In this case, you can enable tcp_syncookies and enter the following command

Echo 1>/proc/sys/NET/IPv4/tcp_syncookies

If no/proc/sys/NET/IPv4/tcp_syncookies are available, your kernel is not supported and you need to recompile the kernel.

At the same time, the number of SYN retries is reduced.

Echo 1>/proc/sys/NET/IPv4/tcp_syn_retries

Echo 1>/proc/sys/NET/IPv4/tcp_synack_retries

Increase syn_backlog to ensure user access (ConsumptionMemoryAt the cost, it is too high ..)

Echo "2048">/proc/sys/NET/IPv4/tcp_max_syn_backlog

If it still does not work, it can only be handed over to the corresponding hardware firewall.