Skip to content

Consider disabling syncookies #354

Open
Open
Consider disabling syncookies#354

Description

@ArrayBolt3
ArrayBolt3
opened on Mar 29, 2026

/usr/lib/sysctl.d/990-security-misc.conf#security-misc-shared currently has this:

## Enable TCP SYN cookie protection to assist against SYN flood attacks.
##
## https://en.wikipedia.org/wiki/SYN_flood
## https://cateee.net/lkddb/web-lkddb/SYN_COOKIES.html
##
## KSPP=yes
## KSPP sets CONFIG_SYN_COOKIES=y.
##
net.ipv4.tcp_syncookies=1

Syncookies rely on embedding special information into into a TCP initial sequence number, which tirdad completely destroys.

Activity

  1. ArrayBolt3 commented on Mar 29, 2026

    @ArrayBolt3
    ArrayBolt3
    on Mar 29, 2026
    ContributorAuthor

    This may not be correct after all, see 0xsirus/tirdad#34 (comment)

  2. ArrayBolt3 commented on Mar 29, 2026

    @ArrayBolt3
    ArrayBolt3
    on Mar 29, 2026
    ContributorAuthor

    We may want to disable this anyway though, 0xsirus/tirdad#34 (comment)

  3. 0xsirus commented on Mar 29, 2026

    @0xsirus
    0xsirus
    on Mar 29, 2026

    This option can be enabled with 1 or 2.
    1 means activate only when queue is full and 2 means always on. 1 which is the default can be worse as it creates the possibility of forced-fallback attacks which can assist with fingerprinting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions