I still don't understand this SYN attack, but now I can block it easily

It's been almost six years [1] since I first started seeing this attack, only now it's no longer from European IP (Internet Protocol) addresses. I'm still unsure what is going on with the attack. There will be up to around 100 connections to the web server in the SYN state, all with different IP addresses, but all apparently from networks in Brazil and it's never enough to really affect the server. I finally got tired of whack-a-mole and filling up my firewall with scores of networks to block. I decided to see what data is actually being sent and hopefully find a better way to block such traffic.

I recalled there was a way to get iptables to log matches, and with some searching of documentation, I was able to get it working:

Note: the options for the LOG target must be after the -j LOG option. I found that out the hard way. Also, the data may not make it to syslog—if it doesn't, use dmesg to read them. Again, I found that out the hard way.

So with that out of the way, I was able to finally get some information about these mysterious SYN requests:

What leapt out at me is the TTL (Time To Live) values—they were always larger than 99. From what I recall, a typical TTL is usually 64 or thereabouts in a normal TCP (Transmisstion Control Protocol) connection. So, making an executive decision, I ran the following command to block SYN packets with a TTL larger than 70:

It didn't break anything apparent. My SSH connection was still live. The web server, gopher and Gemini servers are still getting traffic. I'm still getting email. But I'm no longer seeing connections stuck in the SYN state. It's been about 16 hours or so, and I see I've blocked 171,194 connections. That one new firewall rule seems to have done the trick.

It still doesn't answer why this is being done though. Weird.

Update on Thursday, January 29^th, 2026

Microsoft Windows has a TTL of 128. Of course it does [2]! Sigh.

[1] /boston/2020/04/04.1

[2] /boston/2026/01/29.1

Discussions about this entry

I still don't understand this SYN attack, but now I can block it easily | Lobsters

I still don't understand this SYN attack, but now I can block it easily | Hacker News

I still don't understand this SYN attack, but now I can block it easily - Lemmy: Bestiverse

I still don't understand this SYN attack, but now I can block it easily - ZeroBytes

Lazy Reading for 2026/02/08 – DragonFly BSD Digest

Gemini Mention this post

Contact Sean Conner