Our system uses Cassandra running on Ubuntu 10.04 and during last spike in traffic we observed the following message in logs:
possible SYN flooding on port 9160. Sending cookies.
These machines are not publicly available,the traffic is legitimate - it comes from our own application servers.
Does anybody know what is the consequence of kernel going into the "cookie" mode for the caller? I understand that server stops adding half-open connections (SYN_RECV) to the backlog queue but does it affect the caller (i.e. our .NET application) in any way? Is there some throttling/delay kicking in that may start a vicious cycle?
Given these are internal machines does this protection makes sense? How about the default value