* Question about behaviour of rule in a syn attack.
@ 2013-04-12 23:05 Alex Flex
0 siblings, 0 replies; only message in thread
From: Alex Flex @ 2013-04-12 23:05 UTC (permalink / raw)
To: netfilter
Greetings !
Id be thankful if somebody can shed some light here:
If Iam getting a syn attack, and I have syn cookies enabled via sysctl
would any of these two rules match those connections?
iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above
10 --connlimit-mask 32 -j DROP
iptables -A INPUT -p tcp --syn --dport 80 -m hashlimit
--hashlimit-above 25/second --hashlimit-srcmask 32 --hashlimit-name
IP_LIMIT_REQ -j DROP
Or do these only apply to connections that have undergone the handshake?
Thanks
Alex
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2013-04-12 23:05 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-04-12 23:05 Question about behaviour of rule in a syn attack Alex Flex
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox