Something I’ve been meaning to post for a while is a script that is surprisingly very helpful during times of a SYN_REC flooding attack on a linux server.

It basically consists of a PHP script, a .sh script, and a line in your cron file.

As you’ll see, everything’s done using absolute paths, so feel free to change them to whatever you like. The ”offending” IPs are instantly banned from the server via IPTables, and before anyone says it, the PHP is only there for ease of use, I’m well aware that this could all be done in a single file.

In addition to the two scripts below, stick a basic line in your crontab that will run the .sh every minute. This will in turn invoke the PHP script to handle the processing of the file. If you don’t know how to stick a line in your crontab that will do this, you shouldn’t really be running a server

synstop.sh

#!/bin/bash

netstat -n -p|grep SYN_REC > /root/syndump.txt
# For damage assessment
#netstat -n -p|grep SYN_REC > /root/log_syndump.txt
#uptime > /root/log_uptime.txt
#netstat -n -p > /root/log_complete.txt
php -d disable_functions -d safe_mode=0 /root/synstop.php

synstop.php

<?php
$Out = file_get_contents("/root/syndump.txt");
$Lines = explode("\n", $Out);
if(count($Lines) > 15) {

        $IPArr = array();
        foreach($Lines as $Line) {

preg_match('/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})\:[0-9]{3,6}/',
$Line, $Match);
if(isset($Match[1])) {
                if(!isset($IPArr[$Match[1]]))
                        $IPArr[$Match[1]] = array(1);
                else
                        $IPArr[$Match[1]][] = 1;
}
        }
        foreach($IPArr as $Ip => $Arr) {
		// We only want to ban the IPs if they appear more than 3 times. Otherwise it could be normal traffic, and 

we don't want that.
                if(count($Arr) > 3) {
                        $BanCmd = 'iptables -I INPUT -j DROP -s '.$Ip;
                        `$BanCmd`;
                }
        }

}
?>