#1  
Old 19th April 2010, 16:48
SamTzu SamTzu is offline
HowtoForge Supporter
 
Join Date: Apr 2007
Location: Helsinki
Posts: 426
Thanks: 33
Thanked 54 Times in 37 Posts
Send a message via Skype™ to SamTzu
Angry Syn_recv

Just got syn flooded.
There is about 200 of these coming from Egypt. And the server got sloowwww.
It's cumbersome to do iptables -A INPUT -s 196.218.51.134 -j DROP on all of the IP's.

Any ideas on how to best handle these types of situations?


tcp 0 0 79.134.125.169:80 196.218.51.134:2535 SYN_RECV -
tcp 0 0 79.134.125.169:80 196.218.51.134:1296 SYN_RECV -
tcp 0 0 79.134.125.169:80 196.218.51.134:2130 SYN_RECV -
tcp 0 0 79.134.125.169:80 196.218.51.134:4306 SYN_RECV -
tcp 0 0 79.134.125.169:80 196.218.51.134:1984 SYN_RECV -
tcp 0 0 79.134.125.169:80 196.218.51.134:2536 SYN_RECV -
__________________

Sami Mattila
Internet-Content

Telephone:
00358942833310
Email: firstname.lastname@internet-content.org
Shop: http://shop.internet-content.net
Site: http://www.internet-content.net
Blog: http://www.internet-content.net/en/blog
FB: https://www.facebook.com/internetcontent

Reply With Quote
Sponsored Links
  #2  
Old 20th April 2010, 15:01
falko falko is offline
Super Moderator
 
Join Date: Apr 2005
Location: Lüneburg, Germany
Posts: 41,701
Thanks: 1,900
Thanked 2,722 Times in 2,563 Posts
Default

Is the attack coming from one IP, or does the IP change? If it's from one IP, you can block it like this: http://www.howtoforge.com/forums/sho...42&postcount=4
__________________
Falko
--
Download the ISPConfig 3 Manual! | Check out the ISPConfig 3 Billing Module!

FB: http://www.facebook.com/howtoforge

nginx-Webhosting: Timme Hosting | Follow me on:
Reply With Quote
  #3  
Old 21st April 2010, 08:21
SamTzu SamTzu is offline
HowtoForge Supporter
 
Join Date: Apr 2007
Location: Helsinki
Posts: 426
Thanks: 33
Thanked 54 Times in 37 Posts
Send a message via Skype™ to SamTzu
 
Default

It was only from 2 different IP addresses so it was easy to block with the above command. But since this kind of stuff seems to be growing more common we should find a bit more permanent solution.
__________________

Sami Mattila
Internet-Content

Telephone:
00358942833310
Email: firstname.lastname@internet-content.org
Shop: http://shop.internet-content.net
Site: http://www.internet-content.net
Blog: http://www.internet-content.net/en/blog
FB: https://www.facebook.com/internetcontent

Reply With Quote
Reply

Bookmarks

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT +2. The time now is 04:32.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.