kernel: TCP: Possible SYN flooding on port 80. Sending cookies.

[track1]

Hello,

under litespeed server I'm getting these errors at /var/log/messages :


Oct 10 19:09:27 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:09:27 01 kernel: net_ratelimit: 146 callbacks suppressed
Oct 10 19:09:22 01 last message repeated 9 times
Oct 10 19:09:22 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:09:22 01 kernel: net_ratelimit: 677 callbacks suppressed
Oct 10 19:09:17 01 last message repeated 9 times
Oct 10 19:09:16 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:09:16 01 kernel: net_ratelimit: 696 callbacks suppressed
Oct 10 19:09:12 01 last message repeated 9 times
Oct 10 19:09:11 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:09:11 01 kernel: net_ratelimit: 1309 callbacks suppressed
Oct 10 19:09:07 01 last message repeated 13 times
Oct 10 19:08:52 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:08:52 01 kernel: net_ratelimit: 3 callbacks suppressed
Oct 10 19:07:53 01 last message repeated 9 times
Oct 10 19:07:53 01 kernel: TCP: Possible SYN flooding on port 80. Sending cookies.
Oct 10 19:07:53 01 kernel: net_ratelimit: 233 callbacks suppressed



Server is not under any DoS attacks, is simply getting HUGE traffic.
Is probably caused by some tcp setting not correctly tuned. I have been trying with sysctl.conf settings but no way


some info:

#netstat -ant | grep 80 | wc -l
35643

#netstat -ant | grep 80 | awk '{print $6}' | sort | uniq -c | sort -n
1 CLOSING
2 CLOSE_WAIT
3 LISTEN
5 LAST_ACK
49 FIN_WAIT1
71 FIN_WAIT2
208 SYN_RECV
498 ESTABLISHED
34751 TIME_WAIT

 

[webizen]

pls paste result of

cat /proc/sys/net/ipv4/tcp_fin_timeout
cat /proc/sys/net/ipv4/tcp_syncookies

 

[track1]

current config:

cat /proc/sys/net/ipv4/tcp_fin_timeout
3

cat /proc/sys/net/ipv4/tcp_syncookies
1




disabling tcp_syncookies, i get dropped connection messages instead "Sending Cookies"

 

[NiteWave]

34751 TIME_WAIT

can you list the top 5 IPs in this status?

 

[track1]

there aren't any ip with more than 10 or 15 time out connections, there are thousands of ips with about 5-15 connections.

 

[webizen]

doesn't seem to be lsws related.

try following to reduce # of time_wait connections.

# echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle
or
sysctl -w net.ipv4.tcp_tw_recycle = 1

 

[track1]

tcp_tw_recycle was actually set a 1

doing some tests, disabling litespeed smart keep alive seems to lower time_wait connections to 9.000-10.000