Redhat 7.3
Apache 1.3.27
kernel 2.4.20-smp

Flood from multi ip, big flood, 20 GB traffic/day to 80 port

Have you captured flood packet info, such as the source ip or mac address, some times syn floods originate from virus infected computers on you own network, use tcpdump to capture network traffic. Another messure you could take is to set your kernel up to protect you system with syn cookies. You'll need to set a parameter in the proc file system. The command "echo 1 > /proc/sys/net/ipv4/tcp_syncookies " will set this option for you, in order to set this option at boot time you must edit your /etc/sysctl.conf file, by viewing the file you'll see how kernel options are set. I will suggest that you find the offending host, if it's on your network shut it down and clean it up.
What is your domain name?

Tcpdump sure captures a lot of info!

I have a question about flooding, since my lights on my broadband modem are flickering constantly like a mad fly and tcp dump captured 3600 packets when idle over a minute and 700 packets within two seconds when I clicked "reply" on this site, is this normal, or do I have a flooding problem as well? This is strange, since I have constantly reinstalled operating systems and changed IP's over and over again. Funny, because a few kilobytes of traffic shouldn't generate so much traffic (and lights!) should it? Or is background traffic more busy than I thought (whats the use of it anyway?)?

(Or perhaps one can lock on to physical network adapter addeesses?)

$IPTABLES -t filter -F
$IPTABLES -t mangle -F
$IPTABLES -t filter -X
$IPTABLES -t mangle -X
$IPTABLES -t filter -Z
$IPTABLES -t mangle -Z

/sbin/modprobe -r ipt_state
/sbin/modprobe -r ip_conntrack


$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

/sbin/depmod -a

/sbin/modprobe ip_conntrack
/sbin/modprobe ip_tables
/sbin/modprobe iptable_filter
/sbin/modprobe iptable_mangle
/sbin/modprobe ipt_LOG

....

$IPTABLES -A tcp_packets -p TCP -s 80.193.64.21 --dport 80 -j REJECT
$IPTABLES -A tcp_packets -p TCP -s 195.161.38.93 --dport 80 -j REJECT

....
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $LO_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -i $LO_IFACE -s $INET_IP -j ACCEPT
$IPTABLES -A INPUT -p ALL -d $INET_IP -m state --state ESTABLISHED,RELATED \
-j ACCEPT
$IPTABLES -A INPUT -m limit --limit 3/hour --limit-burst 5 -j LOG \
--log-level DEBUG --log-prefix "IPT INPUT packet died: "


###############################
# OUTPUT chain
#
#
# Bad TCP packets we don't want.
#


#
# Special OUTPUT rules to decide which IP's to allow.
#

$IPTABLES -A OUTPUT -p ALL -s $LO_IP -j ACCEPT
$IPTABLES -A OUTPUT -p ALL -s $INET_IP -j ACCEPT

#
# Log weird packets that don't match the above.
#

$IPTABLES -A OUTPUT -m limit --limit 3/minute --limit-burst 3 -j LOG \
--log-level DEBUG --log-prefix "IPT OUTPUT packet died: "


$IPTABLES -A INPUT -p tcp --dport 80 -m iplimit --iplimit-above 10 -j REJECT


I have banned half of world ! 120-150 ip of flooders, but when i saw netstart -n, i see connections from this ip. Maybe i do somethin wrong ?

It's hard to tell if you experiencing floods( Denial of service ), normally syn floods attack service ports, like in this post the person refers to port 80, the port reserved for HTTP protocol, what is happening? TCP uses TCP three-way handshake, SYN > SYN, ack and ack. The client sends a SYN request to the server, the server replies with a SYN, ack and the client returns an ack. Syn floods( Denial of service ) are programs which send high rates of SYN's to the victim host filling the incomplete connection queue for the TCP port (in this case port 80), also the source IP address of each SYN is set to a random number (IP spoofing) so the server SYN, ack goes nowhere, preventing the server from knowing the real IP address of the program. By filling the incompete queue with bad SYN's real client SYN's are not queued, providing a "Denial of service" to real clients. Setting the syn cookies option allows the server to continue operating as normal. There are volumes of books written on this topic, it's way beyond the scope of a thread, there are allot of computer science students and math professors that publish information on these topics on-line, use a google search to get a bigger picture..
Your tcpdump captures and modem lights questions;
If I am connected to eth1 on a firewall computer using ssh and I run tcpdump on that interface "tcpdump -i eth1" I will capture thousands of packets in a few seconds, why? I have an established connection on port 22 and tcpdump will capture all traffic related to this connection, as with your DSL modem, your machine is probably connecting to a server using PPPoA or PPPoE, which is generating network traffic. Public networks always have loads of harmless traffic on it which tcpdump will capture.