I've got a (TCP) server that handles a big number of new connections per second (1000 - 5000). This causes syn cookies to be send:

kernel: possible SYN flooding on port 2710. Sending cookies. 

Syn cookies aren't that bad (in this case), but how do I avoid this. What app or kernel knobs can I turn? Documentation on this appears to be very scarce. The kernel is Linux 2.6.32 x64.

migrated from stackoverflow.com May 27 '12 at 6:13

This question came from our site for professional and enthusiast programmers.

  • SYN cookies! Om nom nom! – Donal Fellows May 26 '12 at 21:40
up vote 2 down vote accepted

The syncookies is controlled by the setting in /proc/sys/net/ipv4/tcp_syncookies, which you may read the document exist in Linux kernel for more details. To be specific, here's the part which I think is relevant:

    Note, that syncookies is fallback facility.
    It MUST NOT be used to help highly loaded servers to stand
    against legal connection rate. If you see SYN flood warnings
    in your logs, but investigation shows that they occur
    because of overload with legal connections, you should tune
    another parameters until this warning disappear.
    See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.
  • Thanks. So should I increase tcp_max_syn_backlog or the somaxconn? I'm not sure how they interact. – XTF May 26 '12 at 16:56
  • @XTF if I were you, I will try one of them. For example, increase tcp_max_syn_backlog to 7000, to see if it still need to use syncookies or not. – Raymond Tau May 26 '12 at 17:49

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.