Once upon a time, there was a TCP/IP stack and hackers. One of the most popular attacks against TCP/IP stack is TCP SYN flood. It is not just the problem of implementation but also the TCP/IP stack itself. If you have servers in the wild, you must harden those servers.

Windows 2000

Modify values in below registry keys:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

1. SynAttackProtect = 1
2. TcpMaxHalfOpen = 500
3. TcpMaxHalfOpenRetried = 400
4. TcpMaxPortsExhausted = 5

Linux

There is only one modification for Linux.

echo 1 > /proc/sys/net/ipv4/tcp_syncookies

Tags: hardening, tcp/ip, syn flood