Home / server / Questions / 787020
Accepted
Nuno
Asked: 2016-06-30 13:14:33 +0800 CST

Run shell script on the event of "possible SYN flooding"

  • 772

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file.

So, is it possible to trigger a script/command when the kernel alerts for "possible SYN flooding on port XXX" ?

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

linux tcp ddos scalability syn

1 Answers

  1. Best Answer

    In short: yes!

    But that depends a bit in the syslog daemon you're running.

    Syslog-ng allows that with the program() destination.

    Rsyslog offers actions.

    • 2