linux - FreeBSD syncookies 机制

Question

我正在研究 FreeBSD TCP/IP 栈。似乎有 2 种 syn flood 机制，syncookies 和 syncache。我的问题是关于 syncookies，它是从头开始还是在 SYN 队列填满时开始？

Answer 1

manual page对于 syncache/syncookies 包含以下段落，这说明 syncookies 仅在先前的入口已从同步缓存中被逐出时才应用:

 Syncookies provides a way to virtually expand the size of the syncache by
 keeping state regarding the initial SYN in the network.  Enabling
 syncookies sends a cryptographic value in the SYN,ACK reply to the client
 machine, which is then returned in the client's ACK.  If the correspond-
 ing entry is not found in the syncache, but the value passes specific se-
 curity checks, the connection will be accepted.  This is only used if the
 syncache is unable to handle the volume of incoming connections, and a
 prior entry has been evicted from the cache.