monitor received TCP SYN packets by counters

MaliKious

3/28/24, 7:38 PM

trying to monitor received TCP SYN flag packets that are actually counted each and every this kind of packet received, before the connection established.

currently using netstat command, but this is does not have the advantage of counters that actually count.

for example, assume that running the command every 1 minute:

netstat -ant | awk '$6 == "SYN_SENT" {++s} END {print s}'

if the system will get some SYN burst for some reason, between two samples, then the samples are not correct and not accurate:

time of sample	occurance
minute 1:00	sample by netstat command
minute 1:30	TCP SYN burst
minute 2:00	sample by netstat command

that's why counters are needed.

didn't found SNMP counter or any "native" solution for this propose. not interested of installing iptables or any addons which intervene the sessions, it's too risky for production machine.

1 + 5

system-monitor

network-monitoring

Thomas Ward

3/28/24, 8:33 PM

Without traffic monitoring or packet monitoring actively you will *never* be able to detect SYN bursts like you're looking for. You can do a fairly *simple* `iptables` setup that still permits traffic but logs syns so you can find the bursts. But SYNs alone aren't going to help much if this is a production server, SYN packets are part of the standard TCP handshakes. So what exactly do you *want* to achieve here? Blocking SYN bursts and such, or just monitoring for them? (Either solution requires real-time packet monitoring)

MaliKious

3/29/24, 6:02 PM

the main goal is to **monitor** SYN packets. whether are part of TCP session or part of SYN flood or whatever they are part of. are there any packet monitoring tools that not intervene (statefull) the session, and actually have the ability to count every TCP SYN packets ? these counts will be display in grafana widget.

Thomas Ward

3/29/24, 10:59 PM

short of some kind of custom scripting that listens on the interface in promiscuous mode and then live-feeds that into a value that Grafana can show (or a promiscuous mode listener on your interface and then feed each SYN packet into an ES cluster that Grafana can then generate count stats on), I don't think there's any tool that does this *transparently*.

MaliKious

3/30/24, 6:55 AM

no. that's completely not what i'm looking for. put the stats on grafana it's the easiest part. just need a tools to count the receiving SYN packets, that's all.

Thomas Ward

3/30/24, 1:18 PM

you would need a custom solution to make this work. In theory you could do it with `iptables`' LOG mechanism to log all the entries to disk when there's a SYN packet in there, then count the number of lines, etc. in the logs, but as you said you don't want to install `iptables` or anything so that's a non-option. Which then extends to custom solutions, and you indicated you want to use what's "on the system default" (which is "no such tool")

Score:0

Ubuntu

Himanshu Tanwar

7/23/24, 11:31 AM

Use conntrack with watch

watch -n 30 "conntrack -L 2>&1 | grep SYN_SENT | cut -d' ' -f8 | awk '\$1 > 30' | wc -l"

+ 0

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: monitor received TCP SYN packets by counters

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.