On Fri, 29 Oct 2010, Ciaran Johnston wrote:
> A tcpdump shows a large number of SYNs from thousands of different IP
> addresses, with no other ACKs or anything. I'm fairly confident there's
> no TCP connection.
You could try the 'limit' module, however that would affect all SYNs.
The 'recent' module (or maybe a negative 'hashlimit') could perhaps be
used to favour SYNs from sources that have sent one previously (ie
something that's more likely to be a valid request).
IP Sets would be useful for maintaining a cache of source addresses
that have negotiatied valid TCP connections.
If the traffic is originating from a single host then you may find the TTL
on all packets is the same. If so then filtering SYN packets with that
TTL might be effective (but it will also match some valid traffic)
-Ronan
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
