See how fast a SYN flood exhausts the backlog queue and whether SYN cookies are required.
Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients. A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.
SYN Flood Capacity
sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1).
Backlog exhaustion time
time to exhaust = backlog ÷ attack SYN rate
sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1). Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients.
A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.
This calculator takes 5 inputs: SYN backlog queue size, SYN-ACK retransmission attempts, Initial SYN-ACK timeout, Attack SYN rate, Legitimate SYN rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.