From owner-freebsd-questions Mon Mar 15 9:43:24 1999 Delivered-To: freebsd-questions@freebsd.org Received: from relay.ucb.crimea.ua (relay.ucb.crimea.ua [212.110.138.1]) by hub.freebsd.org (Postfix) with ESMTP id 8753F14DF4 for ; Mon, 15 Mar 1999 09:42:33 -0800 (PST) (envelope-from ru@ucb.crimea.ua) Received: (from ru@localhost) by relay.ucb.crimea.ua (8.9.2/8.9.2/UCB) id TAA02119; Mon, 15 Mar 1999 19:41:49 +0200 (EET) (envelope-from ru) Date: Mon, 15 Mar 1999 19:41:48 +0200 From: Ruslan Ermilov To: The Tech-Admin Dude Cc: questions@FreeBSD.ORG Subject: Re: SYN attacks Message-ID: <19990315194148.A841@relay.ucb.crimea.ua> Mail-Followup-To: The Tech-Admin Dude , questions@FreeBSD.ORG References: <19990315100709.D64525@relay.ucb.crimea.ua> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Mailer: Mutt 0.95.3i In-Reply-To: ; from The Tech-Admin Dude on Mon, Mar 15, 1999 at 12:28:48PM -0500 X-Operating-System: FreeBSD 3.1-STABLE i386 Sender: owner-freebsd-questions@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.ORG On Mon, Mar 15, 1999 at 12:28:48PM -0500, The Tech-Admin Dude wrote: > > > On Mon, 15 Mar 1999, Ruslan Ermilov wrote: > > > On Sun, Mar 14, 1999 at 09:51:30PM -0000, geniusj@phoenix.unacom.com wrote: > > > Hi, if this is directed towards the wrong list, please forward it to the > > > correct one.. My concern is that our server has been getting some massive > > > SYN floods from, what we think arespoofed hosts recently. It has brought our > > > system to its knees, even with its power (Dual 400 512 mb of ram). We would > > > like to somehow restrict these zombie connections from building up so much > > > .. I found somewhat of an old kernel patch, but due to the age of it, it isnt > > > applicable any more. I would like any suggestions on stopping or weakening > > > these attacks either by kernel patch or ip filtering.. Any suggestions are > > > welcome. > > > > > > Thanks, > > > Jason DiCioccio > > > > man 4 dummynet > > > > > That looks to be (and as I understood it) for limitting bandwidth > going through a certain device, I dont want to llimit overall bandwidth of > the system, the SYN attacks dont actually take much bandwidth, but they do > take a big chunk of system resources and dont allow anyone else to login > while they are going on.. No, you can limit only packets with SYN bit set. For example, ipfw pipe 1 config bw 1Kbit/s ipfw add pipe 1 tcp from any to setup via -- Ruslan Ermilov Sysadmin and DBA of the ru@ucb.crimea.ua United Commercial Bank +380.652.247.647 Simferopol, Ukraine http://www.FreeBSD.org The Power To Serve http://www.oracle.com Enabling The Information Age To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message