Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a (TCP) server that handles a big number of new connections per second (1000 - 5000). This causes syn cookies to be send:

kernel: possible SYN flooding on port 2710. Sending cookies. 

Syn cookies aren't that bad (in this case), but how do I avoid this. What app or kernel knobs can I turn? Documentation on this appears to be very scarce. The kernel is Linux 2.6.32 x64.

share|improve this question

migrated from May 27 '12 at 6:13

This question came from our site for professional and enthusiast programmers.

SYN cookies! Om nom nom! – Donal Fellows May 26 '12 at 21:40
up vote 2 down vote accepted

The syncookies is controlled by the setting in /proc/sys/net/ipv4/tcp_syncookies, which you may read the document exist in Linux kernel for more details. To be specific, here's the part which I think is relevant:

    Note, that syncookies is fallback facility.
    It MUST NOT be used to help highly loaded servers to stand
    against legal connection rate. If you see SYN flood warnings
    in your logs, but investigation shows that they occur
    because of overload with legal connections, you should tune
    another parameters until this warning disappear.
    See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
share|improve this answer
Thanks. So should I increase tcp_max_syn_backlog or the somaxconn? I'm not sure how they interact. – XTF May 26 '12 at 16:56
@XTF if I were you, I will try one of them. For example, increase tcp_max_syn_backlog to 7000, to see if it still need to use syncookies or not. – Raymond Tau May 26 '12 at 17:49

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.