Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So basically since a few days my internet started being very slow. I checked my router logs and guess what! In the log where it is a record of DoS attacks it showed something like

|Description |Count| Last Occurence | Target| Source |

|TCP- or UDP-based Port Scan | 3 | (current date) |(local ip)| and shame that ip/VPN)|

I think from my observations that is when the DoSer hooks up his ip to mine (or something like that, basically means available to attack)

When I do netstat -an in Terminal (I have a mac btw) and my internet is very slow it says something like this:

Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 (local ip).58188 SYN_SENT
tcp4 0 0 (local ip).58187 SYN_SENT
tcp4 0 0 (local ip).58186 SYN_SENT
tcp4 0 0 (local ip).58185 SYN_SENT
tcp4 0 0 (local ip).58184 SYN_SENT
tcp4 0 0 (local ip).58183 SYN_SENT
tcp4 0 0 (local ip).58182 SYN_SENT
tcp4 0 0 (local ip).58181 SYN_SENT
tcp4 0 0 (local ip).58180 SYN_SENT

While when its not being attacked:

Proto Recv-Q Send-Q Local Address Foreign Address (state)
tcp4 0 0 (local ip).58292 FIN_WAIT_2
tcp4 0 0 (local ip).58275 FIN_WAIT_2
tcp4 0 0 (local ip).58265 ESTABLISHED
tcp4 0 0 (local ip).58264 ESTABLISHED
tcp4 0 0 (local ip).58263 ESTABLISHED
tcp4 0 0 (local ip).58262 ESTABLISHED
tcp4 0 0 (local ip).58261 ESTABLISHED
tcp4 0 0 (local ip).58255 FIN_WAIT_2
tcp4 0 0 (local ip).58254 FIN_WAIT_2
tcp4 0 0 (local ip).58238 ESTABLISHED
tcp4 0 0 (local ip).58071 FIN_WAIT_2
tcp4 0 0 (local ip).58061 FIN_WAIT_2

Somehow that IP is hooked up to my internet so at any time it can DoS me. When it says SYS_SENT its show my internet is under attack. This is really annoying! Can anyone help?

share|improve this question

Contact your ISP. You can't fix this problem yourself, but they might be able to help. And it's in their best interests to do so, even moreso than yours. (After all, it's their network that's carrying this load, using up bandwidth for all their clients.)

share|improve this answer

This should do the trick. This will only allow 5 connections per Host/IP. Downside to this that for example if 10 users where connecting to your site through the same proxy server only 5 of them would be able to connect. Also enabling syn cookies could halt the attack too without affecting users using the same proxy. Here is how to limit number of connections from the same host.

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 5 -j REJECT
service iptables save

This is how to enable syn cookies.

nano /etc/sysctl.conf the add net.ipv4.tcp_syncookies = 1 to the bottom of the file. Then run sysctl -p to enforce changes.

share|improve this answer
also see my other post at… that will also fix your issue – Tim Williams Mar 6 '14 at 5:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.