SYN flood detection lies to you on a SYN-cookie kernel

The problem

Every SYN flood detection script on the internet greps /proc/net/tcp for sockets in state 03 (SYN_RECV) and counts them…