Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time


syncookied logo

Build Status

syncookied emulates linux kernel syncookie functionality by intercepting SYN packets and sending replies to them using the same cookie generation alghorithm. It can achieve better performance under SYN flood attacks thanks to kernel bypass (netmap).


  1. Install rust (instructions here:
  2. Install build-essential and libpcap-dev or equivalent package for your distribution
  3. Install netmap. Make sure netmap.h / netmap_user.h can be found in /usr/include. Alternative you can point CFLAGS variable to their location: example.
  4. run cargo build --release, resulting binary will be found in target/release/syncookied.

Note: we use AVX-accelerated SHA1 function by default. SSE3 implementation is also available under sse3 feature flag, i.e.: cargo build --features=sse3 --no-default-features --release.

How to run

On server you want to protect

  1. Install tcpsecrets linux kernel mode to expose tcp syncookie key and timestamp
  2. Start syncookied in server mode: syncookied server <proto://ip:port>. Running this commands automatically starts a TCP or UDP server on specified ip/port and sets net.ipv4.tcp_syncookies to 2 on first request.

On server you want to use for packet processing

  1. Install netmap and make sure it works (pkt-gen)

  2. Disable NIC offloading features on the interface you want to use (eth2 here):

    ethtool -K eth2 gro off gso off tso off lro off rx off tx off 
    ethtool -A eth2 rx off tx off
    ethtool -G eth2 rx 2048 tx 2048
  3. Set up queues and affinities. Here we bind 12 queues to first 12 cpu cores:

    ethtool -L eth2 combined $QUEUES
    ./set_irq_affinity -x 0-11 eth2

    set_irq_affinity is available at

  4. Create hosts.yml file in the working directory, which looks like this

    - ip:
      secrets_addr: udp://
      mac: 0c:c4:7a:6a:fa:bf

Here ip is external ip you want to protect, secrets_addr is the address of syncookied server running on protected host, and mac is its MAC address.

  1. Run syncookied -i eth2. It will print something like this:

    Configuration: -> c:c4:7a:6a:fa:bf
    interfaces: [Rx: eth2/3c:fd:fe:9f:a8:82, Tx: eth2/3c:fd:fe:9f:a8:82] Cores: 24
    12 Rx rings @ eth2, 12 Tx rings @ eth2 Queue: 1048576
    Starting RX thread for ring 0 at eth2
    Starting TX thread for ring 0 at eth2
    Uptime reader for starting
  2. Configure your network equipment to direct traffic for protected ip to syncookied.

  3. You can reload configuration at any time by changing hosts.yml and sending HUP signal to syncookied. It will print something like this:

    Uptime reader for exiting
    All uptime readers dead
    Old readers are dead, all hail to new readers
    Uptime reader for starting
  4. Enjoy your ddos protection


syncookied has some options you may want to tune, see syncookied --help. If you have more than 1 interface on your server, you may want to look into -O to use second one for TX. This greatly improves performance and latency as forwarding and syn-reply traffic is separated.

Traffic filtering

It's possible to filter traffic by adding "filters" section to host configuration like this:

- ip:
  mac: 0c:c4:7a:6b:0a:78
   tcp and dst port 53: drop
   tcp and dst port 22: pass
   default: pass

Filters are written in pcap syntax. Consult pcap-filter(7) for more information. Default policy is "pass". It can be changed by using default key. Note that filtering happens on layer 4.


Please check the FAQ before filing an issue.

Need help?

Join us on Telegram:


syncookied under 12.65 Mpps syn flood attack utilizing 12 cores of Xeon E5-2680v3: syncookied perf


syncookied is distributed under the term of GPLv2.