Cybersecurity

Hello there,

I want to know what are the ways to monitorize and control/stop flooding on my server, because I am heavily flooded. At this moment I am doing all this manually (when I see that my bandwidth is lowering or some applications are freezing), my main working tool being iptables.But I want something automated .
Another problem : if I am flooded with packets having real ip addresses , with a simple iptables command I cand resolve the problem easily. But, the problem is, in most of the cases, I am flooded with packets with spoofed ip adresses (e.g. 1.2.3.4 ), so the only thing I can do in this situation is to block all incoming packets (which ruins everything).Do you have a solution to this ?
The flood monitorizing (and controlling) tool may be with/without interface, only to be effective.

Thanx,
Adrian

How exactly are you flooded? Is it an DoS attack using SYN flooding? If so, enable SYN Cookies by running

Code:

# echo 1 > /proc/sys/net/ipv4/tcp_syncookies

Is it a break-in attempt against an application like SSH? Then limit the number of connection attempts by matching against a limit (described here; about half-way down the page, search for "limit") or by allowing only a certain number of recent connections (described here).