TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

SYN Packet Handling

1 post · Jan 2018

What this trail covers

Cloudflare's understanding and operation of SYN packet handling in Linux has evolved to include detailed analysis of the SYN and Accept queues, their size limits, and the impact of application performance on connection acceptance. This includes insights into SYN flood mitigation via SYN cookies and the behavior of TCP backlog parameters. The platform continues to refine its ability to manage and debug these critical networking components at scale.

All Cloudflare trails
  1. SYN packet handling in the wildThis post details the inner workings of Linux's TCP SYN packet handling, explaining the roles of the SYN Queue and Accept Queue. It covers queue size limits, the impact of application `accept()` throughput, and the behavior during Accept Queue overflows. It also delves into SYN flood attacks, the role of SYN cookies, and their interaction with TCP timestamps. The post introduces tools like `ss` and custom SystemTap scripts (`resq.stp`, `acceptq.stp`) for observing and debugging these mechanisms.