NAME

     syncache, syncookies — sysctl(8) MIBs for controlling TCP SYN caching

SYNOPSIS

     sysctl net.inet.tcp.syncookies
     sysctl net.inet.tcp.syncookies_only

     sysctl net.inet.tcp.syncache.hashsize
     sysctl net.inet.tcp.syncache.bucketlimit
     sysctl net.inet.tcp.syncache.cachelimit
     sysctl net.inet.tcp.syncache.rexmtlimit
     sysctl net.inet.tcp.syncache.count

DESCRIPTION

     The syncache sysctl(8) MIB is used to control the TCP SYN caching in the system, which is
     intended to handle SYN flood Denial of Service attacks.

     When a TCP SYN segment is received on a port corresponding to a listen socket, an entry is
     made in the syncache, and a SYN,ACK segment is returned to the peer.  The syncache entry
     holds the TCP options from the initial SYN, enough state to perform a SYN,ACK
     retransmission, and takes up less space than a TCP control block endpoint.  An incoming
     segment which contains an ACK for the SYN,ACK and matches a syncache entry will cause the
     system to create a TCP control block with the options stored in the syncache entry, which is
     then released.

     The syncache protects the system from SYN flood DoS attacks by minimizing the amount of
     state kept on the server, and by limiting the overall size of the syncache.

     Syncookies provides a way to virtually expand the size of the syncache by keeping state
     regarding the initial SYN in the network.  Enabling syncookies sends a cryptographic value
     in the SYN,ACK reply to the client machine, which is then returned in the client's ACK.  If
     the corresponding entry is not found in the syncache, but the value passes specific security
     checks, the connection will be accepted.  This is only used if the syncache is unable to
     handle the volume of incoming connections, and a prior entry has been evicted from the
     cache.

     Syncookies have a certain number of disadvantages that a paranoid administrator may wish to
     take note of.  Since the TCP options from the initial SYN are not saved, they are not
     applied to the connection, precluding use of features like window scale, timestamps, or
     exact MSS sizing.  As the returning ACK establishes the connection, it may be possible for
     an attacker to ACK flood a machine in an attempt to create a connection.  While steps have
     been taken to mitigate this risk, this may provide a way to bypass firewalls which filter
     incoming segments with the SYN bit set.

     To disable the syncache and run only with syncookies, set net.inet.tcp.syncookies_only to 1.

     The syncache implements a number of variables in the net.inet.tcp.syncache branch of the
     sysctl(3) MIB.  Several of these may be tuned by setting the corresponding variable in the
     loader(8).

     hashsize     Size of the syncache hash table, must be a power of 2.  Read-only, tunable via
                  loader(8).

     bucketlimit  Limit on the number of entries permitted in each bucket of the hash table.
                  This should be left at a low value to minimize search time.  Read-only, tunable
                  via loader(8).

     cachelimit   Limit on the total number of entries in the syncache.  Defaults to (hashsize ×
                  bucketlimit), may be set lower to minimize memory consumption.  Read-only,
                  tunable via loader(8).

     rexmtlimit   Maximum number of times a SYN,ACK is retransmitted before being discarded.  The
                  default of 3 retransmits corresponds to a 45 second timeout, this value may be
                  increased depending on the RTT to client machines.  Tunable via sysctl(3).

     count        Number of entries present in the syncache (read-only).

     Statistics on the performance of the syncache may be obtained via netstat(1), which provides
     the following counts:

     syncache entries added
                       Entries successfully inserted in the syncache.

     retransmitted     SYN,ACK retransmissions due to a timeout expiring.

     dupsyn            Incoming SYN segment matching an existing entry.

     dropped           SYNs dropped because SYN,ACK could not be sent.

     completed         Successfully completed connections.

     bucket overflow   Entries dropped for exceeding per-bucket size.

     cache overflow    Entries dropped for exceeding overall cache size.

     reset             RST segment received.

     stale             Entries dropped due to maximum retransmissions or listen socket
                       disappearance.

     aborted           New socket allocation failures.

     badack            Entries dropped due to bad ACK reply.

     unreach           Entries dropped due to ICMP unreachable messages.

     zone failures     Failures to allocate new syncache entry.

     cookies received  Connections created from segment containing ACK.

SEE ALSO

     netstat(1), tcp(4), loader(8), sysctl(8)

HISTORY

     The existing syncache implementation first appeared in FreeBSD 4.5.  The original concept of
     a syncache originally appeared in BSD/OS, and was later modified by NetBSD, then further
     extended here.

AUTHORS

     The syncache code and manual page were written by Jonathan Lemon <jlemon@FreeBSD.org>.