All you need to know about SYN floods - Erik's Code

Date: 09 Apr 2012 Author: Erik Dubbelboer SYN cookies So one day I noticed /var/log/syslog on one of our servers was filled with the following message: TCP: Possible SYN flooding on port 80. Sending cookies. This message can come a from a SYN DDOS, but in our case it was because of the amount of new connections one of our application was receiving. The syslog message is emitted when the SYN backlo

[hirose31]

tcp_syncookies , somaxconn , tcp_max_syn_backlog , listen(2)

[yamaz]

Also fixing the SYN flooding problem requires you to modify net.ipv4.tcp_max_syn_backlog, net.core.somaxconn and the backlog size passed to the listen() syscall.

[mxg]

SOMAXCONN