Rode out a SYN flood on a $5 box with two sysctls
Small site got a layer-4 SYN flood, connection table filled, legit users couldn't connect. No fancy DDoS service.
Tuned the kernel to absorb it:
— net.ipv4.tcp_syncookies = 1
— net.ipv4.tcp_max_syn_backlog = 4096
— net.core.somaxconn = 4096
Syncookies let the box answer half-open connections without holding state, so the table stopped filling. Site stayed up through the flood on a $5 VPS. Then I put it behind Cloudflare to stop the next one at the edge.
Try it tonight.
Root Access Daily
@RootAccessDaily
Rode out a SYN flood on a $5 box with two sysctls
Этот пост опубликован в Telegram-канале Root Access Daily. Подписаться можно по ссылке: @RootAccessDaily.