All DDoS Definitions
DDoS Testing Definition

TCP SYN Backlog

The TCP SYN backlog became a security boundary in September 1996, when a SYN flood knocked the New York ISP Panix offline for days and CERT followed with advisory CA-1996-21. It still matters because every TCP listener still has one, it is still finite, and a DDoS test still finds deployments where it is the first thing to break.

The backlog is the kernel queue of half-open connections: a SYN has arrived, the server has answered with a SYN-ACK, and the entry waits for the client's final ACK. When the queue is full, the kernel either drops new SYNs or, if enabled, falls back to SYN cookies.

TCP SYN backlog: the half-open connection queue Attacker floods SYN, spoofed src no final ACK sent half-open SYNs SYN backlog: half-open connections bounded by tcp_max_syn_backlog each slot: a half-open connection awaiting an ACK Legit client SYN arrives dropped: queue full Queue full further SYNs dropped handshakes fail A SYN flood exhausts this queue, not bandwidth: the target is connection state. A test finds the knee: the SYN rate at which the backlog saturates, and whether SYN cookies plus tuning hold. BlackNeuron™
A SYN flood fills the bounded TCP SYN backlog with half-open connections whose final ACK never arrives; once full, the kernel drops further SYNs and legitimate clients cannot connect

How long a slot stays taken

The size of the queue is only half of its capacity. The other half is how long each entry lives, and for an ACK that never comes that is set by the SYN-ACK retry timer. On Linux the default tcp_synack_retries is 5, with the retransmit interval doubling from one second, so an unanswered entry is held for roughly 63 seconds before the kernel gives up on it.

Occupancy is arrival rate multiplied by residence time. A 1,024-entry queue with 63-second residence fills at about 16 spoofed SYNs a second. That is a few kilobits per second, far below anything a bandwidth alarm will notice, which is why a SYN flood is an attack on this queue and not on the pipe.

The same arithmetic shows the tuning levers. Cutting tcp_synack_retries to 2 brings residence down to about 7 seconds and raises the rate needed to fill the queue ninefold. A bigger queue raises it in proportion. Neither removes the problem; both move the knee.

TCP SYN backlog: occupancy is SYN rate times residence time SYNs, no ACK back half-open queue for one listener each entry waits through 5 SYN-ACK retries, about 63 s cap: the listen backlog full: drop, or fall back to cookies 1,024 slots held for 63 s each fill at about 16 spoofed SYNs per second BlackNeuron™
Animation of the TCP SYN backlog filling: SYNs with no returning ACK each hold a half-open slot through five SYN-ACK retries, about 63 seconds, until the listener's queue reaches its cap and a new connection is dropped or handed to SYN cookies

Which number actually caps it

The size is not one knob. On recent Linux kernels the half-open queue for a listener is bounded by the backlog argument the application passes to listen(), clamped to net.core.somaxconn, while tcp_max_syn_backlog adds a further limit when SYN cookies are off. somaxconn defaulted to 128 until kernel 5.4 raised it to 4096, so the same application can get a queue thirty-two times larger on a newer host, and a hardcoded listen(fd, 128) can quietly pull it back down.

That is how a kernel upgrade, a container base-image change or a new reverse proxy opens or closes a gap with no one touching a firewall rule. Connections that do complete move on to a separate queue, the accept queue, which fails for different reasons.

What a DDoS test measures about it

A test drives SYN rate as an explicit axis against each listener that matters and records:

  • The knee. The SYN rate at which half-open entries hit the cap, read from ss -n state syn-recv and checked against the arithmetic above.
  • Overflow behaviour. Whether the kernel logs "Possible SYN flooding on port ... Sending cookies" and keeps serving, or drops new SYNs because cookies are off or a middlebox in front keeps its own smaller table.
  • The counters. TcpExtSyncookiesSent, SyncookiesRecv and SyncookiesFailed from nstat show cookies doing their job; a climbing ListenDrops shows connections being lost.
  • Backscatter. Under the default retry count, every spoofed SYN can earn up to six SYN-ACKs aimed at addresses that never asked. That outbound packet rate is part of the cost, and part of what upstream filtering sees.
  • Real handshakes completed. The only number a user feels: the share of legitimate clients that connect while the flood runs, with cookies on and with them off.

Where the SYN backlog sits among the other state tables an attacker can fill is laid out in understanding DDoS attack vectors.