|
SYN_RECV情况，说白了，是接到SYN包后应当置的情况。关 于SYN_RECV情况,受一些教科书的欺诈,小编之前一直了解为网络服务器接到 SYN包后应当置此情况。也没细想起底是置哪个socket的情况，近期在看三次挥手协议书在linux核心中的完成时,才细心思索这一难题应当是置联接套 接字的情况并非监视套接字的情况。 一般,SYN包仅用于TCP三次挥手协议书中。普遍的tcp三次挥手协议书全过程(自然也有同时联接、半联接等其他一些状况)，以下： 1、client SYN包--- server 2、client ---SYN包/ACK包 server 3、client ACK包--- server 依据tcp情况图,相匹配以下4个情况的转变 a、client推送结束，情况变为SYN_SEND; b、server接到SYN报高并发送ack确定包和SYN包，情况变成SYN_RECV c、client推送ack包结束，情况变为ESTABLISHED d、server推送ack包结束，情况变为ESTABLISHED 在linux核心中,所述好多个情况相匹配为TCP_SYN_SEND、TCP_SYN_RECV、TCP_ESTABLISHED. RFC793中有关SYN_RECV情况的叙述以下： SYN-RECEIVED - represents waiting for a confirming connection request acknowledgment after having both received and sent a connection request. 运用iptables防tcp_syn进攻 改动iptables iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT iptables -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT echo 2048 //ipv4/tcp_max_syn_backlog echo 1 //ipv4/tcp_synack_retries echo 1 //ipv4/tcp_syn_retries echo 1 //ipv4/tcp_syncookies 查寻某ip高并发联接数 netstat -na|grep SYN|awk '{print $5}'|awk -F: '{print $1}'|sort|uniq -c|sort -r 统计分析 netstat -na |grep SYN_RECV |grep 80 |wc -l 查询每个情况数量 netstat -n | awk '/^tcp/ {++S[$NF]} END {for(a in S) print a, S[a]}' sysctl核心 net.ipv4.ip_forward = 0 net.ipv4.conf.default.rp_filter = 1 net.ipv4.conf.default.accept_source_route = 0 kernel.sysrq = 0 kernel.core_uses_pid = 1 net.ipv4.tcp_syncookies = 1 kernel.msgmnb = 65536 kernel.msgmax = 65536 kernel.shmmax = kernel.shmall = net.ipv4.tcp_max_syn_backlog = 65536 dev_max_backlog = 32768 net.core.somaxconn = 32768 net.ipv4.tcp_max_tw_buckets = 5000 net.core.wmem_default = 8388608 net.core.rmem_default = 8388608 net.core.rmem_max = net.core.wmem_max = net.ipv4.tcp_rmem = 4096 86 net.ipv4.tcp_wmem = 4096 66 net.ipv4.tcp_timestamps = 0 net.ipv4.tcp_synack_retries = 2 net.ipv4.tcp_syn_retries = 2 net.ipv4.tcp_tw_recycle = 1 net.ipv4.tcp_tw_reuse = 1 net.ipv4.tcp_mem = 196 net.ipv4.tcp_max_orphans = 3276800 net.ipv4.tcp_fin_timeout = 30 net.ipv4.tcp_keepalive_time = 120 net.ipv4.ip_local_port_range = 1024 65535 企业 zjcoo.co |
