Linux: Turn On TCP SYN Cookie Protection

TCP SYN cookie protection is a mechanism that can be used to defend against SYN flood attacks in Linux. It works by sending a SYN-ACK response to a SYN request with a cookie, which the client must include in the final ACK packet in order to complete the TCP handshake. If the client does not send the correct cookie, the connection is dropped.

To enable TCP SYN cookie protection on a Linux system, you can follow these steps:

1. Open a terminal and use the sudo command to enter a command as the root user:

sudo -i

2. Edit the kernel parameters file (/etc/sysctl.conf) using a text editor:

nano /etc/sysctl.conf

3. Add the following line to the file to enable TCP SYN cookie protection:

net.ipv4.tcp_syncookies=1

4. Save the file and exit the text editor.

5. Apply the changes by running the following command:

sysctl -p

TCP SYN cookie protection should now be enabled on your system. You can verify that it is working by checking the value of the net.ipv4.tcp_syncookies kernel parameter:

sysctl net.ipv4.tcp_syncookies

The output should be 1, indicating that TCP SYN cookie protection is enabled.

Note: TCP SYN cookie protection is just one way to defend against SYN flood attacks. There are other measures that you can take, such as increasing the size of the SYN queue or using a firewall to block malicious traffic. Consult the documentation for your specific system for more information.