What are SYN Cookies; when do they come into play in TR7?

Short answer

SYN Cookies are a TCP technique used against SYN Flood: when the half-open connection queue (SYN backlog) fills up, the system does not allocate space in memory for a new SYN, encodes the connection information as a verifiable value in the sequence number of the SYN-ACK and establishes the connection only when the client returns with the ACK that completes the handshake (RFC 4987). This way, even if SYNs with spoofed sources fill the queue, legitimate connections continue to be established. In TR7, on the L4 DDoS Management screen of the route table, it is the SYN Cookies rule of the SYN Flood box in the TCP band; its default value is Enabled and it comes into play when the number in the SYN Backlog Size field (default 4096) is exceeded. The rule does not drop traffic, does not produce measurements and does not take sources into quarantine.

Where It Is Used in TR7

Where	Field / label	What for
Left Monitor Panel → Route Tables & L4 DDoS → route table → L4 DDoS Management → TCP → SYN Flood box	SYN Cookies rule: Status (Enabled / Disabled) and SYN Backlog Size	Turning the rule on and off and setting the queue size
The rule row in the same box	When on, Kernel SYN-cookie protection is on; it engages past … half-open connections (with the SYN Backlog Size value in its place); when off, Kernel SYN-cookie protection is off in amber	Reading the current state of the rule

• The SYN pressure itself is measured and limited with the SYN Flood: New-TCP Rate rule in the same box (default 500/s per source); its graph is on the Floods tab of the route table Dashboard. The general description of SYN Flood: What is a SYN Flood attack; which rules does TR7 apply against it?
• The change is applied as soon as it is saved with Save; the rule is set separately for each route table.

Common Misconceptions

• "SYN Cookies work on every connection." They come into play only when the number of half-open connections exceeds the SYN Backlog Size value; as long as the queue does not fill up, they have no effect.
• "SYN Cookies drop attack traffic." They do not drop traffic; they make it possible for legitimate connections to be established even if the queue fills up. The rate limit per source and the quarantine are the job of the SYN Flood: New-TCP Rate rule.
• "Turning off the rule returns the backlog value to its previous state." When the rule is turned off, no new queue value is written; the system stays at the last written value.
• "Sources in the whitelist are exempt from SYN Cookies." SYN Cookies are a system setting; they do not recognize the exemption list.

How it is done in the documentation

• SYN Flood · SYN Cookies
• SYN Flood · SYN Backlog Size
• SYN Flood · Scope and Limits

Related questions

• What is a SYN Flood attack; which rules does TR7 apply against it?
• What is the difference between L4 DDoS Protection and L7 DDoS Protection?
• What are Null Flood and Christmas Tree Scan; why does TR7 block these packets without false positive risk?