-1

I'd like to write a script that gets all the stats I need (top IPs, used memory, netstat, etc) at the time I got an SYN flooding, and write to a report file.

So, is it possible to trigger a script/command when the kernel alerts for "possible SYN flooding on port XXX" ?

Jun 27 22:12:21 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:13:22 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies. Jun 27 22:14:25 xxxx kernel: [xxxx.xxxx] possible SYN flooding on port 443. Sending cookies.

Nuno
  • 461
  • 1
  • 5
  • 23

1 Answers1

2

In short: yes!

But that depends a bit in the syslog daemon you're running.

Syslog-ng allows that with the program() destination.

Rsyslog offers actions.

Colt
  • 1,939
  • 6
  • 20
  • 25
HBruijn
  • 72,524
  • 21
  • 127
  • 192
  • Thank you very much. I have succeeded in running a script on the event of SYN Flooding. I use "rsyslog". Very kind regards! – Nuno Jul 02 '16 at 08:35