Recently my server gets syn flood attack. I use hitcount limitation, but I wonder what is the maximum rate of legitimate syn traffic for a single user IP. The source-IP based rule I use is blow;
iptables -A INPUT -p tcp --syn -m recent --update --seconds 15 --hitcount 20 --name SYNF -j DROP
It drops more than the rate 20packets/15seconds.
Also I wonder what is the correlation between connection/time rate and web content or browser behavior.