symptoms of syn attack

yawe_frek · 10-15-2007, 05:06 AM

hello linux geeks,

how do i know if i am under a syn attack and how do i prevent such?

Thanks

conn-fused · 10-15-2007, 09:03 AM

For knowing when you are under the eyes of a SYN scan you could use iptables or snort.

Iptables (your firewall) can watch for bursts of SYN flagged packets (and drop them, with logging if desired). Snort (an IDS) will detect and log many types of attacks.

Either way though, there's not really much you can do to prevent SYN scans per se (because they are externally initiated), beyond silently dropping the offending packets.

win32sux · 10-15-2007, 11:28 AM

By SYN attack do you mean SYN flood attack? If so, the main symptom is that people won't be able to start new connections with your server (existing connections don't get affected). Also, if you use netstat to check for connections in a half-open state you should see tons from random IPs:

Code:

netstat -ant | grep SYN_RECV

SYN cookies are the SYN flood countermeasure of choice.

Code:

echo "1" > /proc/sys/net/ipv4/tcp_syncookies

If the flood is happening from non-spoofed IPs, per IP rate-limiting via iptables will help.

yawe_frek · 10-15-2007, 06:04 PM

thanks conn and win32 i am really glad for the fast reply, after i did netstat -ant | grep SYN_RECV. i saw a lost of syn_recv but they were from my local ip's not from an external ip.

by the way what is an half open connection.

win32sux · 10-15-2007, 06:13 PM

Quote:

Originally Posted by yawe_frek

thanks conn and win32 i am really glad for the fast reply, after i did netstat -ant | grep SYN_RECV. i saw a lost of syn_recv but they were from my local ip's not from an external ip.

Don't forget that SYN flood packets will have have spoofed source addresses most of the time. But assuming you do confirm they come from your LAN boxes, you should still look into it because it could be a symptom of buggy software on your LAN.

Quote:

Originally Posted by yawe_frek

by the way what is an half open connection.

Wikipedia has a pretty concise explanation.