Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

cat /proc/net/netstat shows that:


Num of bad syncookies is received, but system don't send any syncookie。 What i expect is that bad received sysncookies is less than sent syncookies. Who knows the reason?


static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
    struct tcphdr *th = tcp_hdr(skb);
    const struct iphdr *iph = ip_hdr(skb);
    struct sock *nsk;
    struct request_sock **prev;
    /* Find possible connection requests. */
    struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
                               iph->saddr, iph->daddr);
    if (req)
        return tcp_check_req(sk, skb, req, prev);

    nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr,
            th->source, iph->daddr, th->dest, inet_iif(skb));

    if (nsk) {
        if (nsk->sk_state != TCP_TIME_WAIT) {
            return nsk;
        return NULL;

    if (!th->rst && !th->syn && th->ack)
        sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt)); <== check received ack.
    return sk;
share|improve this question

1 Answer 1

Here's the relevant section from cookie_v4_check in net/ipv4/syncookies.c:

    if (tcp_synq_no_recent_overflow(sk) ||
    (mss = cookie_check(skb, cookie)) == 0) {
    goto out;


So, if:

  1. There has been a recent overflow requiring SYN cookies, and
  2. The cookie fails to checks out as a valid regular SYN packet or SYN cookie,

then SyncookiesFailed gets incremented. Otherwise, SyncookiesRecv gets incremented. So, if CONFIG_SYN_COOKIES is enabled in the kernel, and you've been under a new connection load that requires it, you'd expect SyncookiesSent to be positive, and SyncookiesRecv to be positive (but less). As it is, it looks like the only ones you've gotten are invalid.

We're seeing similar numbers, and we think it is because UFW's default rules include dropping packets with an invalid state, which may include outgoing and incoming SYN cookies. You might want to check your firewall config and logs to see if unexpected dropped packets are occurring.

Or, you may just be getting invalid SYN cookies, due to some random attacker. In that case, though, I'd expect some SYN cookies sent.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.