TCP协议书的挥手全过程及怎样运用iptables避免syn进攻

  SYN_RECV情况,说白了,是接到SYN包后应当置的情况。关 于SYN_RECV情况,受一些教科书的欺诈,小编之前一直了解为网络服务器接到 SYN包后应当置此情况。也没细想起底是置哪个socket的情况,近期在看三次挥手协议书在linux核心中的完成时,才细心思索这一难题应当是置联接套 接字的情况并非监视套接字的情况。

一般,SYN包仅用于TCP三次挥手协议书中。普遍的tcp三次挥手协议书全过程(自然也有同时联接、半联接等其他一些状况),以下:

1、client SYN包--- server

2、client ---SYN包/ACK包 server

3、client ACK包--- server

依据tcp情况图,相匹配以下4个情况的转变

a、client推送结束,情况变为SYN_SEND;

b、server接到SYN报高并发送ack确定包和SYN包,情况变成SYN_RECV

c、client推送ack包结束,情况变为ESTABLISHED

d、server推送ack包结束,情况变为ESTABLISHED 在linux核心中,所述好多个情况相匹配为TCP_SYN_SEND、TCP_SYN_RECV、TCP_ESTABLISHED.

RFC793中有关SYN_RECV情况的叙述以下:

SYN-RECEIVED - represents waiting for a confirming connection

request acknowledgment after having both received and sent a

connection request.

运用iptables防tcp_syn进攻

改动iptables

iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT

iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT

iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT

echo 2048 //ipv4/tcp_max_syn_backlog

echo 1 //ipv4/tcp_synack_retries

echo 1 //ipv4/tcp_syn_retries

echo 1 //ipv4/tcp_syncookies

查寻某ip高并发联接数

netstat -na|grep SYN|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -r

统计分析

netstat -na |grep SYN_RECV |grep 80 |wc -l

查询每个情况数量

netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}'

sysctl核心

net.ipv4.ip_forward = 0

net.ipv4.conf.default.rp_filter = 1

net.ipv4.conf.default.accept_source_route = 0

kernel.sysrq = 0

kernel.core_uses_pid = 1

net.ipv4.tcp_syncookies = 1

kernel.msgmnb = 65536

kernel.msgmax = 65536

kernel.shmmax =

kernel.shmall =

net.ipv4.tcp_max_syn_backlog = 65536

dev_max_backlog = 32768

net.core.somaxconn = 32768

net.ipv4.tcp_max_tw_buckets = 5000

net.core.wmem_default = 8388608

net.core.rmem_default = 8388608

net.core.rmem_max =

net.core.wmem_max =

net.ipv4.tcp_rmem = 4096 86

net.ipv4.tcp_wmem = 4096 66

net.ipv4.tcp_timestamps = 0

net.ipv4.tcp_synack_retries = 2

net.ipv4.tcp_syn_retries = 2

net.ipv4.tcp_tw_recycle = 1

net.ipv4.tcp_tw_reuse = 1

net.ipv4.tcp_mem = 196

net.ipv4.tcp_max_orphans = 3276800

net.ipv4.tcp_fin_timeout = 30

net.ipv4.tcp_keepalive_time = 120

net.ipv4.ip_local_port_range = 1024 65535

企业 zjcoo.co

相关阅读