CSM and SYN attack

[p.buitelaar]

Hello,

We did a test initiating a lot of tcp connections (90,000) to the CSM.

The CSM load-balanced the tcp connections evenly across the web-servers, but my http probe took the servers out of service, because it could not get a reply from the webservers.

I don't want to increase the amount of probe retries, because if the increasing detection time in case of a real failure.

Is there any other way to change this behaviour?

Is there any way to limit the incoming tcp connections to the csm on soure ip or source mac basis?

Pieter-Jon Buitelaar

[Gilles Dufour]

Pieter,

there is no way to limit traffic per source ip/mac.

What you can try is limit the number of active open connections using the maxconns command under the real server definition.

If you really want to protect your servers and CSM you will need some IDS device sitting in front of the CSM.

Regards,

Gilles.