On Sunday 12 May 2002 03:52 pm, Jim Roland wrote: > I have a host behind a routed firewall (not a NAT situation) that is > being flooded by randomly spoofed/distributed SYN Flooding. There are > approximately 8-12 pages of SYN_RECV connections, and it effectively > slows down the webserver. > > Is there any software that I can sit on my firewall or on the same host > that will "fake" the SYN/SYN+ACK/ACK handshake, and if a valid SYN, pass > it along to Apache? I need to keep Apache from slowing down. There's nothing really 'fake' about that -- it's a whole TCP connection. Depending on the severity of the flood, a squid with about 16,000 file descriptors and a low timeout may survive it, passing the completed requests back to apache. -- Brian - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
