I still don’t understand this SYN attack, but now I can block it easily
Wednesday, January 28, 2026 I still don’t understand this SYN attack, but now I can block it easily It’s been almost six years since I first started seeing this attack, only now it’s no longer from European IP addresses. I’m still unsure what is going on with the attack. There will be up to around 100 connections to the web server in the SYN state, all with different IP addresses, but all apparently from networks in Brazil and it’s never enough to really affect the server. I finally got tired of whack-a-mole and filling up my firewall with scores of networks to block. I decided to see what data is actually being sent and hopefully find a better way to block such traffic. I recalled there was a way to get iptables to log matches, and with some searching of documentation, I was able to…
