I am running a server that is running a service on port 59380. There are more than 1000 machines out there connecting to that service. Once I need to restart the service all those machines are connecting at the same time.
That made some trouble as I have seen that log entry in kern.log
TCP: Possible SYN flooding on port 59380. *Sending cookies*. Check SNMP counters.
So I changed sysctl net.ipv4.tcp_syncookies
to 0 because the endpoints to not handle tcp syn cookies correctly. Finally I restarted my network to get the changes in production
Next time I had to restart the service, the following message was logged
TCP: Possible SYN flooding on port 59380. *Dropping request*. Check SNMP counters.
How can I prevent the system for doing such actions? All necessary counter measures are done by iptables…
Best Answer
Do not disable SYN cookies, that is incredibly counter-productive, as you can see, instead of the host falling back to cookie'd sockets, it simply drops it.
The correct thing to do is adjust
net.ipv4.tcp_max_syn_backlog
to a high enough value that it no longer fires this warning.You will probably also want to adjust the TCP stack in general to have more memory - a cursory Google for "Linux TCP Tuning" should provide what you need.