cat /proc/net/netstat shows that:


Num of bad syncookies is received, but system don't send any syncookie。 What i expect is that bad received sysncookies is less than sent syncookies. Who knows the reason?


static struct sock *tcp_v4_hnd_req(struct sock *sk, struct sk_buff *skb)
    struct tcphdr *th = tcp_hdr(skb);
    const struct iphdr *iph = ip_hdr(skb);
    struct sock *nsk;
    struct request_sock **prev;
    /* Find possible connection requests. */
    struct request_sock *req = inet_csk_search_req(sk, &prev, th->source,
                               iph->saddr, iph->daddr);
    if (req)
        return tcp_check_req(sk, skb, req, prev);

    nsk = inet_lookup_established(sock_net(sk), &tcp_hashinfo, iph->saddr,
            th->source, iph->daddr, th->dest, inet_iif(skb));

    if (nsk) {
        if (nsk->sk_state != TCP_TIME_WAIT) {
            return nsk;
        return NULL;

    if (!th->rst && !th->syn && th->ack)
        sk = cookie_v4_check(sk, skb, &(IPCB(skb)->opt)); <== check received ack.
    return sk;

Here's the relevant section from cookie_v4_check in net/ipv4/syncookies.c:

    if (tcp_synq_no_recent_overflow(sk) ||
    (mss = cookie_check(skb, cookie)) == 0) {
    goto out;


So, if:

  1. There has been a recent overflow requiring SYN cookies, and
  2. The cookie fails to checks out as a valid regular SYN packet or SYN cookie,

then SyncookiesFailed gets incremented. Otherwise, SyncookiesRecv gets incremented. So, if CONFIG_SYN_COOKIES is enabled in the kernel, and you've been under a new connection load that requires it, you'd expect SyncookiesSent to be positive, and SyncookiesRecv to be positive (but less). As it is, it looks like the only ones you've gotten are invalid.

We're seeing similar numbers, and we think it is because UFW's default rules include dropping packets with an invalid state, which may include outgoing and incoming SYN cookies. You might want to check your firewall config and logs to see if unexpected dropped packets are occurring.

Or, you may just be getting invalid SYN cookies, due to some random attacker. In that case, though, I'd expect some SYN cookies sent.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.