Use TCP Variable tcp_syncookies to prevent "syn flood attack"

A very popular denial of service attack involves a hacker sending many SYN packets to your server but never completing the TCP three way handshake. This quickly uses up slots in the kernel's half open queue preventing legitimate connections from succeeding. This article will walk you through enabling the TCP variable tcp_syncookies to prevent a "syn flood attack".

SYN cookies work by replying to any SYN packet with a SYN|ACK as normal, but it will present a specially-crafted TCP sequence number that encodes the source and destination IP address and port number and the time the packet was sent. Since the attackers addresses are spoofed they would never have gotten this packet at all and the connection would be dropped.

1. Log on to the server via SSH



2. Execute the following command:
/sbin/sysctl -w net.ipv4.tcp_syncookies=1