tcp_syncookie question

[Genes MailLists]

On 06/01/2011 12:57 PM, Bruno Wolff III wrote:
> On Wed, Jun 01, 2011 at 11:09:35 -0400,
> 
> Unless there is some other alternate way to maintain state in the packets,
> the DoS attacks will still work. If you aren't worried about those you
> could turn it off.
> 
> Also, my memory is that there is a threshold for switching to syn cookies.
> I don't remember where I saw the reference, but if that is correct, you
> shouldn't be using them unless your machine is fielding lots of connections.

  I believe there was a proposal a few years ago but I don't know what
became of it.

  I too recall a threshold below which there should be no effect - that
said I also kind of recall it impacting some other tcp options (window
scaling in particular was squeezed out if I remember right to make room
for the cookie) ...

  and therefore some performance degradation when the machine gets busy
... so its never been totally problem free in that sense ...