tl;dr: They backported an existing kernel feature (per-cpu syn cookie generation) to 3.x using iptables (rather than just maintaining a patchset) because they d

tl;dr: They backported an existing kernel feature (per-cpu syn cookie generation) to 3.x using iptables (rather than just maintaining a patchset) because they didn't want to run a current kernel or maintain a fork.