3 ms·
Generating SYN cookies in Linux doesn't work well at those rates without help. That said, it's very possible. Solarflare cards are good at withstanding several
by scurvy 10y ago
Generating SYN cookies in Linux doesn't work well at those rates without help. That said, it's very possible. Solarflare cards are good at withstanding several million PPS SYN floods...provided you license and then extend their IP stack with the card.
Many hardware load balancers can do +100M SYN cookies per second (assuming a proxy/gateway deployment instead of DSR).
So SYN cookie solutions do work; they just don't work great on stock Linux.
Edit: Add clarification about LB deployment. Won't work with DSR.
- jgrahamc 10y agoThat said, it's very possible. Solarflare cards are good at withstanding several million PPS SYN floods...provided you license and then extend their IP stack with the card. Agreed. We use Solarflare cards but we don't syncookie when we get a large flood. We identify the flood and drop it. There's little point firing back millions of useless SYN ACKs per second.
- scurvy 10y agoAgreed. We use Solarflare cards but we don't syncookie when we get a large flood. We identify the flood and drop it. There's little point firing back millions of useless SYN ACKs per second. How do you know what to drop without SYN cookies? If the attacker isn't advanced, sure all the SYN's will look the same. What if the attacker is smart and the SYN's look legit and are spoofed? If you drop those SYN's, you'll run the risk of also dropping legit traffic if you don't use cookies.