For a few days my internet started being very slow. I checked my router logs and guess what! In the log where it is a record of DoS attacks it showed something like

|Description                 |Count|  Last Occurence  | Target| Source     |

|TCP- or UDP-based Port Scan |  3  |  [current date]  |[local ip]||

I think from my observations that is when the DoSer hooks up his IP to mine (or something like that, basically means available to attack)

When I do netstat -an in Terminal and my internet is very slow it says something like this:

Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)    
tcp4       0      0  (local ip).58188       SYN_SENT   
tcp4       0      0  (local ip).58187       SYN_SENT   
tcp4       0      0  (local ip).58186       SYN_SENT   
tcp4       0      0  (local ip).58185       SYN_SENT   
tcp4       0      0  (local ip).58184       SYN_SENT   
tcp4       0      0  (local ip).58183       SYN_SENT   
tcp4       0      0  (local ip).58182       SYN_SENT   
tcp4       0      0  (local ip).58181       SYN_SENT   
tcp4       0      0  (local ip).58180       SYN_SENT

While when its not being attacked:

Proto Recv-Q Send-Q  Local Address          Foreign Address        (state)  
tcp4       0      0  (local ip).58292       FIN_WAIT_2   
tcp4       0      0  (local ip).58275       FIN_WAIT_2  
tcp4       0      0  (local ip).58265       ESTABLISHED   
tcp4       0      0  (local ip).58264       ESTABLISHED    
tcp4       0      0  (local ip).58263       ESTABLISHED    
tcp4       0      0  (local ip).58262       ESTABLISHED    
tcp4       0      0  (local ip).58261       ESTABLISHED     
tcp4       0      0  (local ip).58255       FIN_WAIT_2   
tcp4       0      0  (local ip).58254       FIN_WAIT_2  
tcp4       0      0  (local ip).58238       ESTABLISHED   
tcp4       0      0  (local ip).58071       FIN_WAIT_2  
tcp4       0      0  (local ip).58061       FIN_WAIT_2   

Somehow that IP is hooked up to my internet so at any time it can DoS me. When it says SYS_SENT it shows my internet is under attack. Can anyone help?


Contact your ISP. You can't fix this problem yourself, but they might be able to help. And it's in their best interests to do so, even moreso than yours. (After all, it's their network that's carrying this load, using up bandwidth for all their clients.)

| improve this answer | |

This should do the trick. This will only allow 5 connections per Host/IP. Downside to this that for example if 10 users where connecting to your site through the same proxy server only 5 of them would be able to connect. Also enabling syn cookies could halt the attack too without affecting users using the same proxy. Here is how to limit number of connections from the same host.

iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 5 -j REJECT
service iptables save

This is how to enable syn cookies.

nano /etc/sysctl.conf the add net.ipv4.tcp_syncookies = 1 to the bottom of the file. Then run sysctl -p to enforce changes.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.