SYN Flood Mitigation with synsanity
Jul 12, 2016Theo Julienne

Summary
Introduced synsanity, an iptables module for Linux 3.x, to mitigate SYN flood attacks. synsanity generates SYN cookies outside the LISTEN socket lock, enabling multi-processor utilization during attacks. It validates the ACK packet and then allows it through to the standard Linux SYN cookie code, without touching subsequent packets. This avoids the need for a custom kernel and allows for maintenance of existing, patched kernels. The module is open-sourced.