☰

TCP：端口 80 上可能发生 SYN 泛洪。即使 net.ipv4.tcp_syncookies 设置为零，也会丢弃请求

tag-icon • tag-icon linux centos
TCP：端口 80 上可能发生 SYN 泛洪。即使 net.ipv4.tcp_syncookies 设置为零，也会丢弃请求

我有一个奇怪的问题，net.ipv4.tcp_syncookies设置为零。但我的 /var/log/messages 中仍然有以下警告 TCP: Possible SYN flooding on port 80. Dropping request.

sysctl -a | grep cooki
net.ipv4.tcp_syncookies = 0
net.ipv4.tcp_cookie_size = 0
=========================================
net.ipv4.tcp_max_syn_backlog=500000
=========================================

iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination   

=========================================
Centos 6.2 64bit
Linux 3.0.0+ #1 SMP Fri Oct 26 07:55:47 EEST 2012 x86_64 x86_64 x86_64 GNU/Linux

/var/log/消息

net_ratelimit: 6168 callbacks suppressed
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.
TCP: Possible SYN flooding on port 80. Dropping request.

答案1

每个应用程序在调用 listen 来监听端口时都会传递一个 backlog 参数。如果应用程序处理连接请求的速度很慢，您最终可能会收到一些有点误导性的消息。该参数类似于每个端口的 tcp_max_syn_backlog。

相关内容