How to detect SYN attack

How to detect SYN attack?

During a SYN attack, the attacker is opening lots of connections to you server but never completes the TCP connection establishment process. The state of each connection will stay SYN_RECV. This is how to count such connections:

# netstat -anutp | grep SYN_RECV | wc -l

If the number is >30, it is likely that you are under a SYN attack.

However, I do not recommend to use netstat in automated scripts to monitor traffic. When you are under a real SYN attack, it may run too long and drain lots of CPU resources.

2) You can monitor live bandwidth of the attack using vnstat:

# vnstat -l -i eth0

It is a very useful tool that will definitely help you understand how powerful the attack is.

3) I also recommend you to install an advanced analogue of top called htop and also monitor how the attack affects your CPU resources. Launch htop:

# htop

Press F2, go to 'Display options' and choose 'Display threads in a different color'. You will see system interrupts in pink.

3) Take a look at the SYN packets (notice: ‘SYN segments’ or ‘segments with SYN flag set’ would be more correct, but who cares) - what do they have in common? You will need to replace or remove the interface name and the port number. '-c 100' means 'capture only 100 packets'.

# tcpdump -i eth0 -nn 'tcp port 80' and 'tcp[13] == 2' -c 100