Survive connection floods
Keeps the machine answering when someone floods it with half-open connections.
Why it matters
A SYN flood sends huge numbers of connection requests and never finishes them. Each half-open connection takes memory, so the server fills up and stops answering real visitors. SYN cookies let the machine keep answering while the flood lasts.
How it works
Sets net.ipv4.tcp_syncookies to 1. When the queue of half-open connections overflows, the kernel stops storing them and encodes the needed state in the reply instead, so a flood does not use up memory.
Who should use it
Anything that accepts TCP connections: servers, home labs, laptops running services. It only takes effect under load, so there is little reason to leave it off. Most distributions already enable it.
What you may notice
Nothing, as it only matters during an overload. During a flood, some optional TCP features may be unavailable on the affected connections.
Check it on your computer
Read the current value:
sysctl net.ipv4.tcp_syncookiesApply it by hand
Set it now (until the next restart):
sudo sysctl -w net.ipv4.tcp_syncookies=1Keep it after restarts, in a file you own:
sudo tee /etc/sysctl.d/90-net-tcp-syncookies.conf <<'EOF'
net.ipv4.tcp_syncookies = 1
EOF
sudo sysctl --systemUndo it
Remove the file and restart, or set the old value back with sysctl -w.
Related settings
Sources
- Linux Hardening Guide (madaidans)
- 2.2.2
- Linux kernel documentation
- net