Forum

Hello,

We are having heavy syn_flood on the server with Hiawatha, doesn't look like Hiawatha is stopping the attack.

Any help is appreciated.

Thanks
Andrew.

Hiawatha can't stop that, because no real connections are made. If you are using Linux, you should worry too much. It has protection against lame SYN flood attacks via SYN cookies. Just make sure your distro's kernel has enabled them.

Thanks Hugo,

For future reference of anyone reading this forum.

http://www.faqs.org/docs/securing/chap5sec56.html

Outcome:

Feb 6 16:01:30 server kernel: possible SYN flooding on port 80. Sending cookies.
Feb 6 16:02:30 server kernel: possible SYN flooding on port 80. Sending cookies.
Feb 6 16:03:30 server kernel: possible SYN flooding on port 80. Sending cookies.

Regards
Andrew