Linux sysctl.conf Network Hardening for Anti-DDoS Architecture

Optimize the Linux TCP/IP stack against socket exhaustion, TIME_WAIT overload, and buffer starvation during high packet-per-second floods.

1. Attack Signature & Impact Analysis

High (Kernel Panic / Freeze)

Default Linux kernel settings are tuned for casual desktop or low-traffic setups. Under attack, default TCP queues overflow within milliseconds, causing packet drops.

2. Production Hardening Configuration (`/etc/sysctl.d/99-anti-ddos.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Enable SYN Cookies protection against SYN floods
net.ipv4.tcp_syncookies = 1

# Increase max half-open connection queue length
net.ipv4.tcp_max_syn_backlog = 8192

# Increase maximum listen queue length for sockets
net.core.somaxconn = 65535

# Reuse TIME_WAIT sockets for new connections safely
net.ipv4.tcp_tw_reuse = 1

# Decrease time to hold socket in FIN-WAIT-2 state
net.ipv4.tcp_fin_timeout = 15

# Protect against IP source routing and ICMP smurf attacks
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Apply kernel changes immediately without reboot
sysctl -p /etc/sysctl.d/99-anti-ddos.conf
# Verify active syncookie status
cat /proc/sys/net/ipv4/tcp_syncookies

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: Never set net.ipv4.tcp_tw_recycle = 1 (deprecated in modern Linux kernels, causes drops for NAT/mobile clients). Use tcp_tw_reuse instead.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: