SYN cookies on internal machines

Question

Our system uses Cassandra running on Ubuntu 10.04 and during last spike in traffic we observed the following message in logs:

possible SYN flooding on port 9160. Sending cookies.

These machines are not publicly available,the traffic is legitimate - it comes from our own application servers.

Does anybody know what is the consequence of kernel going into the "cookie" mode for the caller? I understand that server stops adding half-open connections (SYN_RECV) to the backlog queue but does it affect the caller (i.e. our .NET application) in any way? Is there some throttling/delay kicking in that may start a vicious cycle?

Given these are internal machines does this protection makes sense? How about the default value tcp_max_syn_backlog=1024?

Answer 1

You can just disable them using:

echo 0 > /proc/sys/net/ipv4/tcp_syncookies

To make change permanent, edit /etc/sysctl.conf add a line like:

net.ipv4.tcp_syncookies=0

I don't think it will be an issue if the traffic is generated locally and legitimate unless you flood your server yourself :)

Answer 2

Given that this is valid traffic you will want to disable this behavior - there is a significant performance impact for using SYN cookies on each side of the connection. The idea is to prevent the depletion of RAM resources in a SYN flood by shifting the burden to the CPU (memory is not allocated with cookies on until a valid reply is received).

The sequence calculation, though, is computationally intensive and may impact both your application and server, the limiting factor will be CPU. It is a DDoS prevention mechanism, not something you should run when the traffic is known to be good, when that is the case this is essentially a waste of resources. Why do an intensive computation you don't need on all your traffic?

If you do disable the syn cookies and feel that your server is potentially vulnerable as a result, you can either add logic on the server to re-enable cookies when you detect flooding on other ports, or you can place an IDS/LoadBalancer or similar in the middle that has dedicated resources for handling this kind of attack.