Skip to contentSkip to conversation

Question about behaviour of rule in a syn attack.

DISCUSSION Alex Flex 1 participant 1 message Apr 12, 2013

lore
Share & tools
lore

Alex Flex

author
#0 lore raw

Greetings !

Id be thankful if somebody can shed some light here:

If Iam getting a syn attack, and I have syn cookies enabled via sysctl would any of these two rules match those connections?

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j DROP
iptables -A INPUT -p tcp --syn --dport 80 -m hashlimit --hashlimit-above 25/second --hashlimit-srcmask 32 --hashlimit-name IP_LIMIT_REQ -j DROP

Or do these only apply to connections that have undergone the handshake?

Thanks
Alex