Easy Monitoring of SYN-RECV Connections
=======================================

I added a small script that checks how many connections stay in
SYN-RECV. If the count goes above a threshold, the system emails
me using s-nail. Cron runs it every 15 minutes.


Why This Matters
----------------

SYN-RECV happens before any service sees the connection. Too many
of them can fill the kernel's backlog and slow down the system.
It's usually just Internet noise, but a spike can signal a SYN
flood.


Script
------

	#!/bin/sh

	SYN_COUNT=$(ss -tuna | grep -c SYN-RECV)
	THRESHOLD=50

	if [ "$SYN_COUNT" -gt "$THRESHOLD" ]; then
		echo "High SYN-RECV count detected: $SYN_COUNT at $(date)" \
			| s-nail -s "Suspicious SYN threshold" tc
	fi


Using s-nail as a Minimal MTA with a Custom sendmail
----------------------------------------------------

TinyCore has no MTA, so I compiled s-nail and let it handle SMTP
directly. To satisfy programs that expect /usr/sbin/sendmail, I
added a small stub that appends mail to a local mailbox file.

	#!/bin/sh

	MAILBOX="/var/mail/tc"
	FROM="tc@tinycore"
	DATE=$(date)
	CONTENT=$(cat)

	{
		echo "From $FROM $DATE"
		echo "$CONTENT"
		echo ""
	} >> "$MAILBOX"

Cron jobs can report failures through s-nail:

	... | s-nail -s "Job failed" tc


Calling s-nail or mailx
-----------------------

In .profile I display new mail at login:

	mailx -H | grep '^>N' || echo "No emails in mailbox"