Can I filter TCP SYN packets with seq=0

ddostcp

My servers appear to be targeted by a SYN-flood attack. Between 50-600MBit/s, spoofed IPs.

Packets look like this:

IP p.q.r.s.1234 > my.ser.vers.ip.80: Flags [S], seq 0, win 5840, length 0

with p.q.r.s apparently being random. (yes, source port is always 1234)

While this alone is not enough to fill my link, the responses play their part as well and the machines becomes pretty slow.

Is it reasonable to drop TCP SYNs with seq=0?

Best Answer

Sure, you can drop TCP SYNs with seq=0, you'll only have a 1/4294967296 chance (more or less) or dropping a real connection.... BUT:

The actual TCP sequence number is probably not 0!

I don't know what tool you're using (the output format does not quite seem to match either tcpdump or tshark/Wireshark) but both tcpdump and Wireshark actually remember state of TCP streams and subtract the initial sequence number from the value displayed in both seq and ack fields, so that 0 means "whatever the ISN was".

Note this option from the tcpdump manpage:

   -S     Print absolute, rather than relative, TCP sequence numbers.
Related Topic