SYN flood detection lies to you on a SYN-cookie kernel

Half-open connections never reach /proc/net/tcp when SYN cookies are on. Here's what to read instead.

Role

Author & maintainer

Stack

linux, nginx

The problem

Every SYN flood detection script on the internet greps /proc/net/tcp for sockets in state 03 (SYN_RECV) and counts them…