diff -ur linux-2.4.19/Documentation/networking/ip-sysctl.txt linux-2.4.19.new/Documentation/networking/ip-sysctl.txt --- linux-2.4.19/Documentation/networking/ip-sysctl.txt Sat Aug 3 02:39:42 2002 +++ linux-2.4.19.new/Documentation/networking/ip-sysctl.txt Sun Nov 10 18:13:26 2002 @@ -162,7 +162,7 @@ overflows. This is to prevent against the common 'syn flood attack' Default: FALSE - Note, that syncookies is fallback facility. + Note, that syncookies is a fallback facility. It MUST NOT be used to help highly loaded servers to stand against legal connection rate. If you see synflood warnings in your logs, but investigation shows that they occur @@ -170,12 +170,18 @@ another parameters until this warning disappear. See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow. - syncookies seriously violate TCP protocol, do not allow - to use TCP extensions, can result in serious degradation - of some services (f.e. SMTP relaying), visible not by you, - but your clients and relays, contacting you. While you see - synflood warnings in logs not being really flooded, your server - is seriously misconfigured. + The tcp_syncookies option means that when the machine has more than + tcp_max_syn_backlog SYN packets in the queue, it will revert to + sending out SYN cookies. tcp_syncookies depends on a specifically + grafted TCP Sequence number, which the SYN flooder must guess the + correct number of, unless he is actually receiving the SYN/ACK to + himself. + + When SYN cookies are used, all newly opened connections will be unable + to use any advanced features like ECN, SACK or Timestamps. This may + result in serious degradation of some services, and if you see + synflood warnings in your logs, but you are not being flooded, your + server may be misconfigured. tcp_stdurg - BOOLEAN Use the Host requirements interpretation of the TCP urg pointer field.