When I checked the server after getting up this morning, I was shocked to find that the CPU usage had surged to 99%. After investigating for a while, I discovered that it was under a CC attack. A large number of SYN connections appeared in the network connections, consuming all available resources and preventing the website from being accessed from the front end. After a long time, I finally found a solution: blocking SYN connections. This can isolate most attacks. Below, I will share my approach.

Solution

A SYN attack exploits the three-way handshake principle of the TCP/IP protocol by sending a large number of network packets requesting connection establishment without actually establishing the connections. This eventually fills the network queue of the attacked server, preventing normal users from accessing it.

In SSH, you can use the command sysctl -a | grep syn to see the following:

net.ipv4.tcp_max_syn_backlog = 1024
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_synack_retries = 5
net.ipv4.tcp_syn_retries = 5

• tcp_max_syn_backlog is the length of the SYN queue.
• tcp_syncookies is a switch that determines whether the SYN Cookie feature is enabled. This feature can prevent some SYN attacks.
• tcp_synack_retries and tcp_syn_retries define the number of SYN retries.

Increasing the SYN queue length allows more network connections waiting to be connected; enabling the SYN Cookie feature can block some SYN attacks; reducing the number of retries is also somewhat effective.

Recommended values:

net.ipv4.tcp_max_syn_backlog = 2048
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_synack_retries = 3
net.ipv4.tcp_syn_retries = 3

After setting these parameters, you can effectively isolate CC attacks caused by SYN connections.