CONFIG_SYN_COOKIES: IP: TCP syncookie support

General informations

The Linux kernel configuration item CONFIG_SYN_COOKIES has multiple definitions:

IP: TCP syncookie support found in net/ipv4/Kconfig

The configuration item CONFIG_SYN_COOKIES:

• prompt: IP: TCP syncookie support
• type: bool
• depends on: (none)
• defined in net/ipv4/Kconfig
• found in Linux kernels: 2.6.35–2.6.39, 3.0–3.19, 4.0–4.20, 5.0–5.19, 6.0–6.8, 6.9-rc+HEAD

Help text

Normal TCP/IP networking is open to an attack known as "SYN flooding". This denial-of-service attack prevents legitimate remote users from being able to connect to your computer during an ongoing attack and requires very little work from the attacker, who can operate from anywhere on the Internet.

SYN cookies provide protection against this type of attack. If you say Y here, the TCP/IP stack will use a cryptographic challenge protocol known as "SYN cookies" to enable legitimate users to continue to connect, even when your machine is under attack. There is no need for the legitimate users to change their TCP/IP software; SYN cookies work transparently to them. For technical information about SYN cookies, check out https://cr.yp.to/syncookies.html.

If you are SYN flooded, the source address reported by the kernel is likely to have been forged by the attacker; it is only reported as an aid in tracing the packets to their actual source and should not be taken as absolute truth.

SYN cookies may prevent correct error reporting on clients when the server is really overloaded. If this happens frequently better turn them off.

If you say Y here, you can disable SYN cookies at run time by saying Y to "/proc file system support" and "Sysctl support" below and executing the command

echo 0 > /proc/sys/net/ipv4/tcp_syncookies

after the /proc file system has been mounted.

If unsure, say N.

IP: TCP syncookie support (disabled per default) found in net/ipv4/Kconfig

The configuration item CONFIG_SYN_COOKIES:

• prompt: IP: TCP syncookie support (disabled per default)
• type: bool
• depends on: (none)
• defined in net/ipv4/Kconfig
• found in Linux kernels: 2.5.45–2.5.75, 2.6.0–2.6.34

Help text

Normal TCP/IP networking is open to an attack known as "SYN flooding". This denial-of-service attack prevents legitimate remote users from being able to connect to your computer during an ongoing attack and requires very little work from the attacker, who can operate from anywhere on the Internet.

SYN cookies provide protection against this type of attack. If you say Y here, the TCP/IP stack will use a cryptographic challenge protocol known as "SYN cookies" to enable legitimate users to continue to connect, even when your machine is under attack. There is no need for the legitimate users to change their TCP/IP software; SYN cookies work transparently to them. For technical information about SYN cookies, check out http://cr.yp.to/syncookies.html.

If you are SYN flooded, the source address reported by the kernel is likely to have been forged by the attacker; it is only reported as an aid in tracing the packets to their actual source and should not be taken as absolute truth.

SYN cookies may prevent correct error reporting on clients when the server is really overloaded. If this happens frequently better turn them off.

If you say Y here, note that SYN cookies aren't enabled by default; you can enable them by saying Y to "/proc file system support" and "Sysctl support" below and executing the command

echo 1 >/proc/sys/net/ipv4/tcp_syncookies

at boot time after the /proc file system has been mounted.

If unsure, say N.

Hardware

LKDDb

Raw data from LKDDb:

• (none)

Sources

This page is automaticly generated with free (libre, open) software lkddb(see lkddb-sources).

The data is retrived from:

• Linux kernel
• Linux Kernel Driver DataBase (LKDDb)

Automatic links from Google (and ads)

Custom Search

Popular queries: