How to reduce the impact of SYN-flood?

Question

linux

There is a problem with the incoming SYN flood. Output "netstat -n --tcp | grep SYN_RECV | wc -l" = 512 When the SYN count drops, the network server starts responding. What methods of struggle to consider?

Answer 1

Enable syn cookies, for starters:
Wait, wait...
512 connections in the SYN_RECV state - is this a flood for you?
What kind of server do you have?
Upd.: Look in dmesg - your conntrack table is not overflowing, by any chance?
Usually a large number of connections (when it is really a large number of connections, 65K and above) clogs the conntrack table - and then the symptoms similar to those described by you begin. Either I did not understand the phrase "the server over the network starts to respond."

Answer 2

run SYNPROXY
Homemade DDoS Protection Using IPTables' "SYNPROXY"