1

I asked somewhere else, and I got this response:

Using DROP turns any type of DDoS attack into a SYN flood, because your server expects ACK responses which it will never get. Even if you can fine tune your tcp timeout options some of the settings are hardcoded into the kernel. A REJECT is very quick and takes tiny bandwidth. For more information Google "drop vs reject".

I researched on what he said and he seems correct, but I just want to make sure.

LanguagesNamedAfterCofee
  • 121

1 Answers1

6

Using DROP makes him wait for a timeout (the packet is dropped before it reaches your application). You don't send anything back.

Using REJECT you send a RST packet, saying the port is closed.

Using DROP is better for DoS protection, since you don't send anything out. Using REJECT is a "nicer", since someone connecting to you by mistake, knows the port is closed immediately, and does not have to wait for a timeout.

A syn flood is when someone sends alot of syn packets to start alot of connections (fake or not), and you reserve resources for each connection, while there are no real users to use them. Since you use up all your resources, legit users cannot use your service.

mulaz
  • 10,962