I still don't understand this SYN attack, but now I can't block it easily

I did not get the memo that Windows uses an IP (Internet Protocol) TTL (Time To Live) of 128.

On the one hand, I was able to avoid that weird SYN attack I've been under for six years, quite a bit of spam, and less bad web bot activity for the past 24 hours. On the other hand, any legitimate traffic to my web site from Windows users was lost. On the gripping hand, is anybody using Windows to read my site? I don't know, but it was worrisome enough for me to remove the filter.

In the time it took me to type netstat -an (which displays all the network connections on the server) right after removing the filter, I had over 100 IP addresses in the SYN_RECV state:

Normally, I might see one or two such entries from netstat -an but not over 100. And as I've stated, this isn't enough to be an actual DoS (Denial of Service Attack) or even a DDoS (Distributed Denial of Service Attack), but it is enough to be annoying. I can block the attack easily enough but it's a game of whack-a-mole—I can block 45.227.44.0/23 but in a few days, this will return from yet another Brazilian network, like 168.195.0.0/23 from the other day. And that's what I don't get about this—what is the end game here? What are the operators from this attack hoping to gain? From the comments I've received, one other person has seen a similar attack [1] so at least I'm not alone in this. And I checked with some other customers at my hosting company and yes, they too are being hit with this attack.

The fact that this all stopped the second I filtered out IP packets with a TTL greater than 70 tells me this is from exploited Windows systems. Are they in fact actual Brazilian computers? Or Windows computers elsewhere forging IP addresses? Is this an SYN flood attack that might have worked 30 years ago but not on today's Internet?

I don't know.

All I do know is I wish I had a way to stop it. And what's the thought behind this attack?

Maybe it is indeed, worth adding the IP TTL filter back and just deal with no one using Windows being able to hit my site, just to avoid the crap traffic.

[1] https://news.ycombinator.com/item?id=46806561

Discussions about this entry

Lazy Reading for 2026/02/08 – DragonFly BSD Digest

Gemini Mention this post

Contact Sean Conner