Brazilian SYN Flood Mystery: A Six-Year Cybersecurity Puzzle Finally Solved

For nearly six years, a mysterious SYN flood attack has plagued a web server, with connections originating from Brazilian IP addresses that never quite overwhelmed the system but created a persistent nuisance. The attacker's methodology remained elusive—hundreds of connections would appear in the SYN state with different IP addresses, yet the impact never escalated to a full denial-of-service. The administrator, growing weary of the whack-a-mole approach of blocking individual networks, decided to investigate the actual data being transmitted.

The breakthrough came through iptables' logging capabilities. By configuring the firewall to log matching packets with TCP and IP options, the administrator captured detailed information about these suspicious connections. The log entries revealed a consistent pattern: each SYN packet contained identical TCP options (020405140103030801010402) and arrived with Time-To-Live values consistently above 99, significantly higher than the typical TTL of around 64 seen in normal TCP connections.

This observation led to an elegant solution. Rather than attempting to identify and block specific IP addresses or networks—a strategy that had proven futile given the attacker's use of numerous different addresses—the administrator implemented a simple TTL-based filter. By dropping all incoming SYN packets with TTL values greater than 70, the attack was effectively neutralized without disrupting legitimate traffic. The rule worked seamlessly: SSH sessions remained active, web servers continued serving content, and email delivery proceeded uninterrupted.

The results were immediate and dramatic. Within approximately 16 hours, the new firewall rule had blocked 171,194 connection attempts, effectively ending the six-year mystery attack. The TTL-based approach proved superior to traditional IP-based blocking because it targeted a characteristic of the attack traffic itself rather than trying to keep pace with the attacker's changing source addresses.

Despite solving the immediate problem, the fundamental question remains unanswered: why was this attack being conducted in the first place? The relatively low volume and consistent pattern suggest it may have been a reconnaissance effort, a misconfigured tool, or perhaps an attempt to probe for specific vulnerabilities without triggering alarms. The attacker's choice of Brazilian IP addresses and the consistent use of high TTL values remain unexplained, leaving this cybersecurity puzzle with a practical solution but an unresolved motive.

This case illustrates an important principle in network defense: sometimes the most effective solutions target traffic characteristics rather than source identification. By focusing on the anomalous TTL values rather than the ever-changing IP addresses, the administrator transformed a years-long maintenance headache into a simple, maintainable firewall rule that continues to protect the server without requiring constant updates or monitoring.