Server Configuration to Prevent SYN Attacks and Block SYN-Recv Connections

When I checked the server after getting up this morning, I suddenly found that the CPU usage had soared to 99%. After investigating for a while, I discovered that it was being subjected to a CC attack. A large number of SYN connections appeared in the network connections, consuming all available resources and preventing the frontend from opening the website. After a long time, I finally found a solution: block SYN connections. This can isolate most attacks. Below, I’ll share my approach.

Solution

A SYN attack exploits the three-way handshake principle of the TCP/IP protocol by sending a large number of network packets to establish connections without actually completing the connections. This eventually fills the network queue of the attacked server, preventing normal users from accessing it.

In SSH, you can use the command sysctl -a | grep syn to see the following:

net.ipv4.tcp_max_syn_backlog = 1024net.ipv4.tcp_syncookies = 0net.ipv4.tcp_synack_retries = 5net.ipv4.tcp_syn_retries = 5

• tcp_max_syn_backlog is the length of the SYN queue.
• tcp_syncookies is a switch that determines whether the SYN Cookie feature is enabled. This feature can prevent some SYN attacks.
• tcp_synack_retries and tcp_syn_retries define the number of SYN retries.

Increasing the SYN queue length allows more network connections to wait for connection establishment; enabling the SYN Cookie feature can prevent some SYN attacks; reducing the number of retries also has some effect.

Recommended values:

net.ipv4.tcp_max_syn_backlog = 2048net.ipv4.tcp_syncookies = 1net.ipv4.tcp_synack_retries = 3net.ipv4.tcp_syn_retries = 3

After setting these parameters, you can effectively isolate CC attacks caused by SYN connections.