Skip to content
ENExplore Calculators

SYN Flood Capacity Calculator

See how fast a SYN flood exhausts the backlog queue and whether SYN cookies are required.

About SYN Flood Capacity Calculator

Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients. A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.

Formulas

SYN Flood Capacity

sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1).

backlog
Half-open connection queue depth
hold time
How long an unanswered SYN-ACK occupies a slot
sustainable SYN rate
Arrivals the queue can retire per second

Backlog exhaustion time

time to exhaust = backlog ÷ attack SYN rate

attack SYN rate
Spoofed SYNs arriving per second

Worked example

With the default values below, SYN Flood Capacity Calculator returns Time To Exhaust Backlog of 0.021. Change any input above and every figure here is recalculated in your browser.

Inputs used

SYN backlog queue sizeminimum 1 entries
1,024 entries
SYN-ACK retransmission attemptsaccepts 1–8 attempts
5 attempts
Initial SYN-ACK timeoutminimum 100 ms
1,000 ms
Attack SYN rateminimum 1 SYN/s
50,000 SYN/s
Legitimate SYN rateminimum 1 SYN/s
400 SYN/s

Results

Time To Exhaust Backlog
0.021 s
Half-Open Entry Hold Time
31.0 s
Sustainable SYN Rate
33.0 SYN/s
SYN Cookies Needed
Yes — enable SYN cookies
Legitimate Connections Dropped
91.7%

Step by step

  1. 1Values used
  2. 2SYN Flood Capacity
  3. 3Backlog exhaustion time
  4. 4Time To Exhaust Backlog= 0.021 s
  5. 5Half-Open Entry Hold Time= 31.0 s
  6. 6Sustainable SYN Rate= 33.0 SYN/s
  7. 7SYN Cookies Needed= Yes — enable SYN cookies
  8. 8Legitimate Connections Dropped= 91.7

Assumptions and limits

  • The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 3 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is SYN Flood Capacity calculated?

sustainable SYN rate = backlog ÷ hold time, where hold time = initial RTO × (2^retries − 1). Each unanswered SYN holds a backlog slot for the whole SYN-ACK retransmission sequence — roughly 31 seconds with five retries at a 1 second base. Little's law then gives the arrival rate the queue can retire, and anything above it fills the queue and starts refusing real clients.

Why does SYN Flood Capacity matter?

A backlog of a thousand entries retires only a few dozen SYNs per second, so even a laptop can exhaust it — which is why SYN cookies, not a bigger backlog, are the real defence.

What values do I need to enter?

This calculator takes 5 inputs: SYN backlog queue size, SYN-ACK retransmission attempts, Initial SYN-ACK timeout, Attack SYN rate, Legitimate SYN rate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Related Calculators

SYN Flood Capacity Calculator | Calcrivo