Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a server that is running a service on port 59380. There are more than 1000 machines out there connecting to that service. Once I need to restart the service all those machines are connecting at the same time.

That made some trouble as I have seen that log entry in kern.log

TCP: Possible SYN flooding on port 59380. *Sending cookies*.  Check SNMP counters.

So I changed sysctl net.ipv4.tcp_syncookies to 0 because the endpoints to not handle tcp syn cookies correctly. Finally I restarted my network to get the changes in production

Next time I had to restart the service, the following message was logged

TCP: Possible SYN flooding on port 59380. *Dropping request*.  Check SNMP counters.

How can I prevent the system for doing such actions? All necessary counter measures are done by iptables...

share|improve this question
up vote 8 down vote accepted

Do not disable SYN cookies, that is incredibly counter-productive, as you can see, instead of the host falling back to cookie'd sockets, it simply drops it.

The correct thing to do is adjust net.ipv4.tcp_max_syn_backlog to a high enough value that it no longer fires this warning.

You will probably also want to adjust the TCP stack in general to have more memory - a cursory Google for "Linux TCP Tuning" should provide what you need.

share|improve this answer

Also read following pages . Maybe should check again .

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.