CentOS - May 2015 - New approach syncookies help me

Hello Everyone,
I have 2 different suggestions about syn-cookies method which is used to
block syn-flood attacks.

Syn cookies bitwise image
 ---------------------------------------------
   T(5 bits) ---MSS(3 bits)-----H(24 bits)
---------------------------------------------
So,
1- T value can be decreased to 2 bit which is already 5 bit.And hash value
will be 27 bit.
2-Normally syn-cookies is activated when syn-list is fulled.
At this point  I suggest a hybrid system.Syn packages and eck packages
which received to server will be counted, if the difference is bigger than
a reference value syn-cookies will be activated.
In other words syn-cookies mechanism will be in automatic control.
Now I have two questions;
1-How can I invoke syn-cookies structure into Linux Kernel?
2-How can I know when syn-list is fulled?

Thank you everyone,
if you have any suggestions please let me know.

On 05/12/2015 05:57 AM, Ibrahim Celikbilek wrote:
> I have 2 different suggestions about syn-cookies method which is used to
> block syn-flood attacks.
You're probably better off on the kernel devel list or a TCP specific list.
> 1- T value can be decreased to 2 bit which is already 5 bit.And hash value
> will be 27 bit.
Why?  You'd lose a tremendous amount of resolution on the time value and 
gain a tiny bit better hash value.  And since the current implementation 
encodes TCP options in the t value, you'd lose a significant feature of 
the existing implementation.
> 2-Normally syn-cookies is activated when syn-list is fulled.
Which is pretty much the only time it makes sense to do so, since you 
lose TCP features when you use the syn cookie mechanism.  Earlier you 
proposed a per-connection cookie, or something of that sort, but TCP 
flood attacks, which syn cookies are designed to work around, will 
almost always come in with random/forged source host and port values. 
Since those values can't be authenticated in the syn packet, the 
existing trigger on memory limits are the only logically correct trigger 
for the syn cookie mechanism.
> At this point  I suggest a hybrid system.Syn packages and eck packages
> which received to server will be counted, if the difference is bigger than
> a reference value syn-cookies will be activated.
You're actually describing the way that the system already works.  The 
difference between those two values will be the size of the syn queue. 
The "reference value" is the maximum size.