SYN attacks (correction)

[David]

Mark Picone wrote:

> you should add
> net.inet.tcp.drop_synfin=1 to /etc/sysctl.conf so it gets piped into sysctl
> on boot
> or just run sysctl net.inet.tcp.drop_synfin=1 as root

Unlikely the attacks will have both the SYN and FIN flags set.

Perhaps verifying net.inet.tcp.syncookies is set to 1 and use 
ipfw+dummynet to rate limit incoming SYN packets.

> 
> -----Original Message-----
> From: owner-freebsd-security at freebsd.org
> [mailto:owner-freebsd-security at freebsd.org] On Behalf Of Mark Picone
> Sent: Wednesday, 7 April 2004 10:57 am
> To: freebsd-security at freebsd.org
> Subject: RE: SYN attacks
> 
> You could try adding this to /etc/sysctl.conf
> 
> sysctl net.inet.tcp.drop_synfin=1
> 
> -----Original Message-----
> From: owner-freebsd-security at freebsd.org
> [mailto:owner-freebsd-security at freebsd.org] On Behalf Of Spades
> Sent: Wednesday, 7 April 2004 3:02 am
> To: freebsd-questions at freebsd.org
> Cc: freebsd-security at freebsd.org
> Subject: SYN attacks
> 
> Heya,
> 
> FREEBSD 4.9-STABLE
> 
> Is there anyway to block SYN attacks and prevent it from bring down my
> server?
> 
> Its been attacking for sometime.
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
> 
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
> 
> _______________________________________________
> freebsd-security at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe at freebsd.org"
>