Detect SYN flood slowing down server with netstat

If the web server is slow, detect a SYN flood by netstat -ant | grep :443 | grep SYN_RECV to show the IP addresses leaving it hanging. Hint: If you're behind a reverse proxy, and that shows IP addresses that aren't the proxy's, then your IP is being hit directly. To find out how many IPs are hanging, do netstat -ant | grep :443 | grep SYN_RECV | wc -l. If you do it a few times and the number is increasing, you may be under attack. If it's over 100, that's suspicious, but manageable and the server can usually handle it, especially if you have SYN cookies activated. If it's over 1000, you're under attack.

Comments

No comments yet. Why don’t you start the discussion?

Leave a Reply