Why don't you guys just run the most modern stable Kernel as opposed to 3.X? You say: While Linux 4.x has a patch to send SYN cookies under a per-CPU-core sock

Why don't you guys just run the most modern stable Kernel as opposed to 3.X? You say: While Linux 4.x has a patch to send SYN cookies under a per-CPU-core socket lock, which does fix the problem, we wanted a solution that allowed us to use an existing, maintained kernel with upstream security patches. We didn’t want to roll and maintain an entire custom kernel and all related future security patches just to mitigate this form of attack. Patching Linux 3.x to backport the socket lock change was also a similar maintenance burden we wanted to avoid. But, if this is the case, what's wrong with using Linux's LTS kernel, or the stable current kernel? The kernel.org team does a great job maintaining these. Which upstream vendor are you relying on? Depending on your workload, and your kernel version, there are some fairly large performance improvements. These performance improvements in my testing primarily land in networking and I/O -- effecting many applications. I think your work is awesome. I just think backporting, and not installing linux-image-generic might be a lot work for not much benefit. I'd love to hear your reasoning that leads you to believe that's a better option for security or stability compared to using the trusty kernel. Also, typo: `causese all` -> `causes all`.