FWSpoof

Python tool to detect and auto-block SYN flood / SYN+RESET spoofing invisible in HTTP logs — parses tcpdump text, tracks 3 levels (/16→/24→/32 CRC32), manages iptables DROP.

Quick Start

tcpdump -r examples/sample.cap -nn -s0 | python3 main.py -T -S -V
sudo tcpdump -i eth0 -nn -s0 tcp and dst 10.0.5.10 | sudo python3 main.py -C INPUT -S
# test mode -T never touches iptables, -D keeps block, -s blocks /32 not /24

Thresholds

Block only when global -M 20 per /16 and per-subnet -m 3 SYN / -r 5 SYN+RESET exceeded. Config: config.yaml > FWSPOOF_* env > CLI.

allowed.ips whitelist (one IP/line, -a) • Flags [S],[R] (-F) • Chain INPUT/FORWARD/OUTPUT (-C)
Systemd: /etc/systemd/system/fwspoof.service → tcpdump | python main.py

Author t3ch w4d4f4k@gmail.com • 180 commits • Tests: python -m unittest discover tests/ -v • v1.0.0 modular rewrite