Tuning Solaris Networking for Apache


From the  SunSolve  web site, a search for "SYN flood" yielded some hints about how to tune networking parameters for Solaris aimed at avoiding denial of service attacks.  (Note, you might need a registered account in order to perform such a search.)

I found the following document

Infodoc ID: 17585
Synopsis: How to defend a system from TCP SYN Flood attacks - Ref: CERT CA-96.21
Date: 28 Aug 1998

The synopsis of this document is as follows.

For Solaris 2.5 systems, patch 103447-10  (or later) must be installed.

For Solaris 2.5.1 systems, patch 103582-16 (or later) must be installed.

Both of these patches add TCP tuning parameters to avoid SYN flood attacks.
 

Parameter names and suggested values

The following parameters are available for reducing the effects of a SYN flood attack.  These parameters can be queried or changed using the ndd(1M) command

tcp_conn_req_max_q0 (default 1024):
The maximum number of connections with handshake incomplete.  A SYN flood attack could only affect this queue, and a special algorithm makes sure that valid connections can still get through.

tcp_conn_req_max_q (default 128):
The maximum number of completed connections waiting to return from an accept call as soon as the right process gets some CPU time.

These two parameters replace tcp_conn_req_max which originally had a default value of 32.

The new limits (see above) should be sufficient to fend off a SYN attack and to make sure that valid connections will be accepted, so in most cases you would not need to tune them.
 

I am not sure that  I believe the above statement - dlc

Are we under attack?

The following suggestion was also included in this document for determining if a system is under a SYN attack.

If your system seems to be slow in accepting network connections and you believe that you have become a victim of a SYN flood attack, run the following command:
 

# netstat -sP tcp


Look for values greater than 0 for both tcpListenDropQ0 and tcpHalfOpenDrop.
 

Additional documentation

Also at  SunSolve , there is another document

Infodoc ID: 12618
Synopsis: TCP/IP PSD/FAQ
Date: 13 Oct 1999

This is a  TCP/IP tuning  document, which I downloaded and cleaned up the site specific HTML.
 

Further Hints

When using netstat(1m)  to diagnose problems on a Web server, or any other machine which is likely to have many external connections, make sure that you specify the -n option.  This option prevents netstat from trying to perform an IP address to name lookup which is extremely slow.