Linux anti-SYN flood attack

Protect Against SYN

SYN attack is the principle of using TCP/IP Protocol 3-time handshake, sending a large number of network packets to establish the connection, but not actual

Establish a connection that eventually causes the network queue of the attacked server to be full and inaccessible to normal users.

The Linux kernel provides several SYN-related configurations, with commands:

sysctl-a | grep syn

See:

Net.ipv4.tcp_max_syn_backlog = 1024

net.ipv4.tcp_syncookies = 0

Net.ipv4.tcp_synack_retries = 5

Net.ipv4.tcp_syn_retries = 5

Tcp_max_syn_backlog is the length of the SYN queue, tcp_syncookies is a switch, whether to open the Syn Cookie

feature that prevents partial SYN attacks. Tcp_synack_retries and tcp_syn_retries define SYN

Number of retries.

Increasing the SYN queue length can accommodate more network connections waiting to be connected, and opening the SYN cookie feature can block some

SYN Attacks, reducing the number of retries also have a certain effect.

Here's how to adjust the settings above:

Increase the SYN queue length to 2048:

Sysctl-w net.ipv4.tcp_max_syn_backlog=2048

To open the SYN cookie feature:

Sysctl-w Net.ipv4.tcp_syncookies=1

To reduce the number of retries:

Sysctl-w net.ipv4.tcp_synack_retries=3

Sysctl-w net.ipv4.tcp_syn_retries=3

To maintain the above configuration for system restart, add the above command to the/etc/rc.d/rc.local file.

Linux anti-SYN flood attack