Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've got a (TCP) server that handles a big number of new connections per second (1000 - 5000). This causes syn cookies to be send:

kernel: possible SYN flooding on port 2710. Sending cookies. 

Syn cookies aren't that bad (in this case), but how do I avoid this. What app or kernel knobs can I turn? Documentation on this appears to be very scarce. The kernel is Linux 2.6.32 x64.

share|improve this question

migrated from stackoverflow.com May 27 '12 at 6:13

This question came from our site for professional and enthusiast programmers.

    
SYN cookies! Om nom nom! –  Donal Fellows May 26 '12 at 21:40
add comment

1 Answer

up vote 2 down vote accepted

The syncookies is controlled by the setting in /proc/sys/net/ipv4/tcp_syncookies, which you may read the document exist in Linux kernel for more details. To be specific, here's the part which I think is relevant:

    Note, that syncookies is fallback facility.
    It MUST NOT be used to help highly loaded servers to stand
    against legal connection rate. If you see SYN flood warnings
    in your logs, but investigation shows that they occur
    because of overload with legal connections, you should tune
    another parameters until this warning disappear.
    See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
share|improve this answer
    
Thanks. So should I increase tcp_max_syn_backlog or the somaxconn? I'm not sure how they interact. –  XTF May 26 '12 at 16:56
    
@XTF if I were you, I will try one of them. For example, increase tcp_max_syn_backlog to 7000, to see if it still need to use syncookies or not. –  Raymond Tau May 26 '12 at 17:49
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.