Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

Is there a way to limit the number of concurretly open AF_INET sockets (only)? If so, how do I do it, and how will the networking behave if I'm above the limit?

For background: My cheap commodity router is a bit eager to detect 'syn flooding'. When it does, it crashes (and doesn't automatically restart itself). I'm thinking limiting concurrent connections to around 1000 should keep it from bickering.

share|improve this question
    
SYN packets are only send when a new connection is created. A syn flood refers to a huge number of newly created connections in a short time. Concurrency connections is another thing. This answer on Stackoverflow might help understanding how to limit concurrency connections. –  Lekensteyn Jun 23 '11 at 8:45
    
I fixed my syn-flooding by 'updating' my netgears firmware to dd-wrt. It let me set settings for max connections and timeouts for tcp and udp direct on the router (it is the router crashing the wireless not the OS ;) ) –  Rinzwind Jun 23 '11 at 9:22

1 Answer 1

up vote 2 down vote accepted

You can limit the number of connections at once by using iptables & the connlimit module.

From the iptables man page:

# allow 2 telnet connections per client host
iptables -A INPUT -p tcp --syn --dport 23 -m connlimit --connlimit-above 2 -j REJECT

# you can also match the other way around:
iptables -A INPUT -p tcp --syn --dport 23 -m connlimit ! --connlimit-above 2 -j ACCEPT

# limit the number of parallel HTTP requests to 16 per class C sized network (24 bit netmask)
iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 16 --connlimit-mask 24 -j REJECT

# limit the number of parallel HTTP requests to 16 for the link local network
(ipv6) ip6tables -p tcp --syn --dport 80 -s fe80::/64 -m connlimit --connlimit-above 16 --connlimit-mask 64 -j REJECT
share|improve this answer
    
Fantastic. Thanks a lot. I was waiting for a an answer to this for quite some time. Now, the problem with my router is kind of hard to reproduce, so I'll just assume this works and accept it. It looks like it's just what I need to do. –  Stefano Palazzo Aug 9 '11 at 11:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.