Performance Tuning & Kernel Parameters (Sysctl)

Stop TCP syn floods from eating your connection table

🧩 The Challenge

Dealing with a load balancer that suddenly decides to dump thousands of half-open connections onto your web server is a nightmare. You watch the socket count climb until the machine just stops accepting new logins and everything grinds to a halt.

💡 The Fix

Flip on TCP syncookies and tune the backlog to give your server a fighting chance to handle the handshake overflow. This basically tells the kernel to stop saving state for every single connection until it actually proves it’s a real client.

sysctl -w net.ipv4.tcp_syncookies=1
sysctl -w net.ipv4.tcp_max_syn_backlog=4096
sysctl -p

⚙️ Why It Works

Syncookies change the game because they generate a sequence number based on the connection details rather than keeping a record in the limited memory buffer. The kernel only validates the connection once the final ACK comes back, preventing the queue from filling up with garbage.

🚀 Pro-Tip: Keep an eye on netstat -s | grep -i syn; if you see drops even with cookies on, your backlog is still too small for the incoming firehose.

Linux Tips & Tricks | © ngelinux.com | 11/12/2026