kernel: possible SYN flooding on port 80. Sending cookies.

[ukagg]

Hi,

Looks like my server is under ddos attack.

Apache keeps failing.

/var/log/messages shows following:-

Dec 20 23:18:11 ns4 kernel: possible SYN flooding on port 80. Sending cookies.
Dec 20 23:19:11 ns4 kernel: possible SYN flooding on port 80. Sending cookies.
Dec 20 23:20:14 ns4 kernel: possible SYN flooding on port 80. Sending cookies.
Dec 20 23:21:15 ns4 kernel: possible SYN flooding on port 80. Sending cookies.

I have already enabled Connection Tracking (CT_LIMIT = 120) in CSF firewall, but still attack continues. Can someone help.

Thanks
UKA

 

[GaryT]

In CSF config Look for:

SYNFLOOD = 1