Good Vibrations

Sals Secrets

3 min read

·

Aug 31, 2026

--

2

Listen

Share

I’m pickin’ up good vibrations …

Syn Flood Detecting Socket Filter

I have been implementing a Syn Flood detector that would block any IP address that was obviously syn flooding my server. So, I decided to ask AI about it and see where it could take me. The following are the questions that I asked listed and numbered in order. I include a paraphrasal of the AI’s responses to those questions in parenthesis. After a couple hours of copying from the output to my machine, compiling, launching, testing and upgrading per instructions, the net result is a decent MVP that is currently keeping syn floods out of my server running on a Linux box. The delivered code had one bug that took a programmer to fix. Some naming changes were required as new suggestions were merged into the kit.

1. I am making my own intrusion detection system and I start dropping connections when an address shows to be a syn flooder. Should I block it in UFW or just keep blocking it at the server?
(RAG’s the question from stackoverflow, serverfault etc. Basically, absolutely start blocking with netfilter via UFW.)

2. I am using java and could use some code examples
(Shows me how to launch UFW edits from java code)

3. doesn’t ufw access require root privileges
(Delivers recipe to whitelist app launch user for access to UFW)

4. I have made my own C code access to pcap to observe connections and flows programmatically but I haven’t incroporated that into my java with JNI. Since, I wrote the server in java, I spawn socket handling with each connection. At that point, I increment a connection count. It seems to work well and only slows the server on continued synflood receipts.
(You can use java but why not just write a C-Code application to do all of the work. Leave the java server out of it.)

5. can you implement the syn counter code above in C accessing libpcap along with the code to access ufw<Do it for me!>
(Delivers a very basic implementation with faults alleviated in subsequent inquiries, asks about linux service)

6. yes, please write a systemd service unit file so this C sniffer runs automatically in the background
(Delivers recipe to make it a Linux Service)

7. shouldn’t track_and_evaluate use a hashmap of ip address rather than an array that must be traversed in a for loop<It used an array>?
(Agrees to my assertion and changes the O(N) full array scan to an O(1) HashMap)

8. this code adds the local NAT address of the server to the evalutation hash. why would that happ<Was catching the server, so needed to filter>?
(Adds some filtration ideas and asks about port of server)

9. it listens on 9443
(Adds some code to leverage server port for filtration)

10. The code doesn’t seem to have a ttl on the count. how would I implement that<Would block everyone eventually>?
(Adds TTL to count)

11. a reaper that unblocks after an hour would be good to have
(Adds block TTL, a reaper thread, and unblock function, asks about testing or whitelisting)

12. I’m ready to test
(Bunch of test code in python)

13. I’d like to add a like to add a whitelist mechanism
(Delivers the upgrade code for good white list impl to prefilter)

Here are some console prints of the tool running

EVAL 45.148.10.247
[IDS ALERT] SYN Flood! Attacker: 45.148.10.247
Rule inserted
[IDS WARNING] Successfully injected UFW block rule for: 45.148.10.247
EVAL 89.248.173.161
EVAL 89.248.173.218
EVAL 66.132.172.143
EVAL 66.132.172.16
EVAL 91.189.91.62
EVAL 94.231.206.9
EVAL 137.184.23.73
EVAL 94.231.206.4
EVAL 94.231.206.12
EVAL 8.234.53.50
EVAL 107.189.19.172
EVAL 40.160.16.154
EVAL 94.231.206.11
EVAL 172.56.124.17
EVAL 74.7.241.184
EVAL 158.94.209.62
EVAL 172.56.125.139
EVAL 216.226.76.10
EVAL 91.189.91.97
EVAL 170.79.120.143
[IDS INFO] Ban expired for IP: 93.123.109.166. Cleaning firewall…
Rule deleted
[IDS INFO] Successfully removed UFW block for: 93.123.109.166
EVAL 69.6.222.143
EVAL 91.189.91.96
EVAL 172.232.221.148
EVAL 108.179.225.18
EVAL 85.217.140.15
EVAL 94.154.43.129
EVAL 91.92.241.196
[IDS INFO] Ban expired for IP: 195.178.110.103. Cleaning firewall…
Rule deleted
[IDS INFO] Successfully removed UFW block for: 195.178.110.103
[IDS INFO] Ban expired for IP: 45.148.10.247. Cleaning firewall…
Rule deleted
[IDS INFO] Successfully removed UFW block for: 45.148.10.247