DoS attack protection

Types

TCP SYN flood

More information about this type of attack: SYN flood.

Diagnose

Huge amount of received syn-sent tcp packets can be observed in firewall connection list.

/ip firewall connection print

Protection

• Limit incoming connections

add chain=forward protocol=tcp connection-limit=LIMIT,32 disabled=no \
dst-address-list=TO src-address-list=FROM action=drop 

where LIMIT is max. connection count pre IP, TO and FROM are address list for filtering

• Action tarpid
• SYN filtering
• SYN cookies

External links

• Denial-of-service attack on wikipedia