Shulou(Shulou.com)06/01 Report--

This article to share with you is about the principle of SYN attack in Linux is what, Xiaobian think quite practical, so share to everyone to learn, I hope you can read this article after some harvest, not much to say, follow Xiaobian to see it.

SYN attack principle:

TCP requires a three-way handshake before passing data. SYN attacks work by sending SYN packets to the server and forging the source IP address.

When the server receives a SYN packet, it adds the connection to the backlog queue, sends a SYN-ACK packet to the source IP, and waits for an ACK packet to complete the three-way handshake to establish the connection.

Because the source IP address is forged and there is no host IP, the server cannot receive ACK packets and will continue to retransmit them. At the same time, the backlog queue is filled with SYN connections that are constantly being attacked, resulting in failure to process normal connections.

Countermeasures for SYN Attack

In view of several links of SYN attack, the corresponding processing methods are proposed:

Method 1: Reduce the number of SYN-ACK packet retransmissions (default is 5):

The code is as follows:

sysctl -w net.ipv4.tcp_synack_retries=3

sysctl -w net.ipv4.tcp_syn_retries=3

Method 2: Using SYN Cookie Technology:

The code is as follows:

sysctl -w net.ipv4.tcp_syncookies=1

Method 3: Add backlog queue (default is 1024):

The code is as follows:

sysctl -w net.ipv4.tcp_max_syn_backlog=2048

Method 4: Limit SYN concurrency:

The code is as follows:

iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT --limit 1/s

The above is what the principle of SYN attack in Linux is, Xiaobian believes that some knowledge points may be seen or used in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.