In Windows XP SP2 and Windows Vista, a lot of users have been searching for tcpip.sys patched hack or auto patcher that unlocks the TCP/IP half-open simultaneous connection limit to no upper bound. In a web server that exposes to Internet, the other way round may be true, where there may be a need to limit and restrict maximum number of TCP incoming connections to a web server that are allowed at any one time.
Limiting maximum incoming TCP web connections to the web server is useful to prevent or better still, stop DDoS (Distributed Denial of Service) or DoS (Denial of Service) attacks. DDoS attacks can consume tremendous amount of system resources and CPU load, slow down the web page serving time or response time to the legitimate visitors. And in worse case, the attack can hang and bring down the web server completely, even if you have dual quad-core CPU dedicated server with multiple GBs of memory.
To prevent and response to Denial of Service attacks, other than using firewall or SYN cookies, it’s also possible to limit number of TCP connections that server can accept per second. The concept may applied also when a web page is been digged, stumbled or farked which bring large amount of viewers in short time span. However, this workaround only intend to make the server ‘survives’ and not completely brought down by massive amount of connections. And the restriction will apply on valid human visitors to the websites hosted on server too if the limitation hit its bound and actively denies new connections.
Administrator can use iptables to set the maximum limit on number of TCP connections to the server per second acceptable. To configure the limit, login as root to shell and issue the following commands, replacing <n> with the number of connections per second you want to set, and <m> with burst rate which u want the server to start applying the limit, both without brackets.
iptables -t nat -N syn-flood
iptables -t nat -A syn-flood -m limit –limit <n>/s –limit-burst <m> -j RETURN
iptables -t nat -A syn-flood -j DROP
iptables -t nat -A PREROUTING -i $EXT_IFACE -d $DEST_IP -p tcp –syn -j syn-flood
Commands above will limit maximum number of TCP connections that can connect to web server to n connections per second, after m connections have been established. There is not fixed figure to the number of connections you can set. If the server is powerful it’s possible to increase the values to handle and accept more connection in order to reduce any drop connections. Try and set the best values for your server.
LK is a technology writer for Tech Journey with background of system and network administrator. He has be documenting his experiences in digital and technology world for over 15 years.Connect with LK through Tech Journey on Facebook, Twitter or Google+.
