应对synflood 攻击的方法

xyaxlz 发表于 2011-12-21 08:43

<DIV>判断synflood 攻击的方法(需要根据具体环境，灵活改变参数) #netstat –an |grep SYN_RECV |wc –l 上面的结果如如大于400 有可能为synflood攻击。</DIV>
<DIV>1、首先开启syncookie 此为6 次握手才建立起来的TCP 连接。此种方法在10M以下的流量还可以。 在redhat5.5以后是默认开启的 #echo 1 > /proc/sys/net/ipv4/tcp_syncookies</DIV>
<DIV> 2、把syn ack回应包有5改为3。 #echo 2 > /proc/sys/net/ipv4/synack_retries #echo 2 > /proc/sys/net/ipv4/tcp_syn_retries</DIV>
<DIV> </DIV>
<DIV>3、增大半地址池： #echo 4096 >/proc/sys/net/ipv4/tcp_max_syn_backlog = 4096</DIV>
<DIV>4、把配置加入配置文件，重启机器配置不会消失 #vim /etc/sysctl.conf 加入下面的配置 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 4096 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 2 net.ipv4.tcp_rmem = 32768 net.ipv4.tcp_wmem = 32768</DIV>
<DIV>#sysctl -p</DIV>
<DIV> 5、加入防火墙规则对Iptables 配置（限制接受包和回应包的速度） iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT</DIV>
<DIV>iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT </DIV>
<DIV>iptables -t filter -A INPUT -p tcp --syn -j DROP</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV>6、</DIV>
<DIV>
#!/bin/sh bip=`tail -n 100000  access.log | awk ' $9 ~ "/" ' | awk '$11 == "499" || $11 == "301" ' |awk '$12 == "0"|| $12 == "306" '|awk '$13 == "\"-\""'|awk '{print $2}'|sort -n|uniq -c |sort -n|tail -n 100|awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"` echo "$bip" >> /root/iptables2.txt for ip in $bip; do     /sbin/iptables -A INPUT -s  $ip -j DROP; echo $ip done 7、
#!/bin/sh bip=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "499"  ' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"` bip2=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "301"  ' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"` echo "$bip2" >> /root/iptables2.txt echo "$bip" >> /root/iptables2.txt for ip in $bip; do     /sbin/iptables -A INPUT -s  $ip -j DROP; echo $ip done for ip2 in $bip2; do     /sbin/iptables -A INPUT -s  $ip2 -j DROP; echo $ip2 done sleep 15 bip=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "499"  ' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"` bip2=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "301"  ' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "xxx.231.xxx.195|xxx.2xx.40.131"` echo "$bip2" >> /root/iptables2.txt echo "$bip" >> /root/iptables2.txt for ip in $bip; do     /sbin/iptables -A INPUT -s  $ip -j DROP; echo $ip done for ip2 in $bip2; do     /sbin/iptables -A INPUT -s  $ip2 -j DROP; echo $ip2 done sleep 15 bip=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "499"  ' |awk '$12 == "0" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "220.231.22.195|124.207.40.131"` bip2=`tail -n 1000  /usr/local/nginx-rewrite/logs/rewrite.xxxx.com  | awk ' $9 ~ "/" ' | awk '$11 == "301"  ' |awk '$12 == "306" || $12 == "185" '|awk '$13 == "\"-\""' | awk '{print $3}' | sort -nr | uniq -c | sort -nr |awk '$1 > 4'  | awk '{print $2}'|grep -vE "xx0.2xx.22.1xx|xx.2xx.xxx.131"` echo "$bip2" >> /root/iptables2.txt echo "$bip" >> /root/iptables2.txt for ip in $bip; do     /sbin/iptables -A INPUT -s  $ip -j DROP; echo $ip done for ip2 in $bip2; do     /sbin/iptables -A INPUT -s  $ip2 -j DROP; echo $ip2 done </DIV>

页: [1]

Chinaunix's Archiver

应对synflood 攻击的方法