SYN Flood Capacity Calculator
See how fast a SYN flood exhausts the backlog queue and whether SYN cookies are required.
Inputs
Time To Exhaust Backlog
0.021s
Half-Open Entry Hold Time
31.0s
Sustainable SYN Rate
33.0SYN/s
SYN Cookies Needed
Yes — enable SYN cookies
Legitimate Connections Dropped
91.7%
Step by step
Values used
SYN backlog queue size = 1,024 entries; SYN-ACK retransmission attempts = 5 attempts; Initial SYN-ACK timeout = 1,000 ms; Attack SYN rate = 50,000 SYN/s; Legitimate SYN rate = 400 SYN/s
SYN Flood Capacity
sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1).
Backlog exhaustion time
time to exhaust = backlog ÷ attack SYN rate
Time To Exhaust Backlog
= 0.021 s
Half-Open Entry Hold Time
= 31.0 s
Sustainable SYN Rate
= 33.0 SYN/s
SYN Cookies Needed
= Yes — enable SYN cookies
Legitimate Connections Dropped
= 91.7
How it works
Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients. A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.
Formulas
SYN Flood Capacity
sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1).
- backlog
- Half-open connection queue depth
- hold time
- How long an unanswered SYN-ACK occupies a slot
- sustainable SYN rate
- Arrivals the queue can retire per second
Backlog exhaustion time
time to exhaust = backlog ÷ attack SYN rate
- attack SYN rate
- Spoofed SYNs arriving per second
Frequently Asked Questions
How is SYN Flood Capacity calculated?
sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1). Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients.
Why does SYN Flood Capacity matter?
A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.
What values do I need to enter?
This calculator takes 5 inputs: SYN backlog queue size, SYN-ACK retransmission attempts, Initial SYN-ACK timeout, Attack SYN rate, Legitimate SYN rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
You might also need
- Packets Per Second CalculatorCommonly used together
- Connection Timeout CalculatorCommonly used together
- Session Capacity CalculatorCommonly used together
- Bandwidth Delay Product CalculatorAlso in TCP & Transport
- TCP Window Size CalculatorAlso in TCP & Transport
- Congestion Window CalculatorAlso in TCP & Transport