Messages in this thread | | | Date | Sat, 10 Oct 2009 15:01:33 +0200 | Subject | Enable syn cookies by default | From | Olaf van der Spek <> |
| |
Hi,
I'm forwarding Debian feature request #520668.
Could syn cookies be enabled by default?
AFAIK syn cookies only get send when the half-open TCP connection queue is full. So stuff like window scaling should work fine in normal situations.
Speaking of which: When the half-open TCP connection queue is full and syn cookies are enabled, you get a message like "kernel: possible SYN flooding on port 2710. Sending cookies." However when syn cookies are disabled, you don't get any message (in kern.log), although connections to your server are timing out. Could such a message be added? Maybe with a suggestion to increase the size of that queue or to enable syn cookies.
Greetings,
Olaf
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520668 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=520667 https://bugs.launchpad.net/ubuntu/+bug/57091
| |