From owner-freebsd-security@FreeBSD.ORG  Tue Apr  6 19:09:35 2004
Return-Path: <owner-freebsd-security@FreeBSD.ORG>
Delivered-To: freebsd-security@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id C2E2E16A4CE
	for <freebsd-security@freebsd.org>;
	Tue,  6 Apr 2004 19:09:35 -0700 (PDT)
Received: from fep3.cogeco.net (smtp.cogeco.net [216.221.81.25])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 2BF4C43D46
	for <freebsd-security@freebsd.org>;
	Tue,  6 Apr 2004 19:09:35 -0700 (PDT)	(envelope-from ph1@cogeco.ca)
Received: from cogeco.ca (d141-218-183.home.cgocable.net [24.141.218.183])
	by fep3.cogeco.net (Postfix) with ESMTP id 121DB53AB
	for <freebsd-security@freebsd.org>;
	Tue,  6 Apr 2004 22:08:29 -0400 (EDT)
Message-ID: <40736392.8060708@cogeco.ca>
Date: Tue, 06 Apr 2004 22:12:34 -0400
From: David <ph1@cogeco.ca>
User-Agent: Mozilla Thunderbird 0.5 (Windows/20040207)
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: freebsd-security@freebsd.org
References: <402CF87001176A54@> (added by postmaster@iprimus.com.au)
In-Reply-To: <402CF87001176A54@> (added by postmaster@iprimus.com.au)
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: SYN attacks (correction)
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Security issues [members-only posting]
	<freebsd-security.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-security>,
	<mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 07 Apr 2004 02:09:35 -0000

Mark Picone wrote:

> you should add
> net.inet.tcp.drop_synfin=1 to /etc/sysctl.conf so it gets piped into sysctl
> on boot
> or just run sysctl net.inet.tcp.drop_synfin=1 as root

Unlikely the attacks will have both the SYN and FIN flags set.

Perhaps verifying net.inet.tcp.syncookies is set to 1 and use 
ipfw+dummynet to rate limit incoming SYN packets.

> 
> -----Original Message-----
> From: owner-freebsd-security@freebsd.org
> [mailto:owner-freebsd-security@freebsd.org] On Behalf Of Mark Picone
> Sent: Wednesday, 7 April 2004 10:57 am
> To: freebsd-security@freebsd.org
> Subject: RE: SYN attacks
> 
> You could try adding this to /etc/sysctl.conf
> 
> sysctl net.inet.tcp.drop_synfin=1
> 
> -----Original Message-----
> From: owner-freebsd-security@freebsd.org
> [mailto:owner-freebsd-security@freebsd.org] On Behalf Of Spades
> Sent: Wednesday, 7 April 2004 3:02 am
> To: freebsd-questions@freebsd.org
> Cc: freebsd-security@freebsd.org
> Subject: SYN attacks
> 
> Heya,
> 
> FREEBSD 4.9-STABLE
> 
> Is there anyway to block SYN attacks and prevent it from bring down my
> server?
> 
> Its been attacking for sometime.
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
> 
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
> 
> _______________________________________________
> freebsd-security@freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-security
> To unsubscribe, send any mail to "freebsd-security-unsubscribe@freebsd.org"
>