# Networking: TCP: request_sock_TCP: Possible SYN flooding on port 80. Sending cookies. Check SNMP counters.

**Code:** `Possible SYN flooding on port 80. Sending cookies.` · **Category:** Networking · **Seen on:** Linux, Networking

The server's pending-connection queue filled, so the kernel switched to SYN cookies to survive.

## Meaning

It can be a real SYN flood or just a traffic spike with a small backlog. Raise `net.core.somaxconn` and `net.ipv4.tcp_max_syn_backlog`, keep `tcp_syncookies=1`, rate limit with the firewall or a CDN/WAF, and check the application accepts connections quickly.

## Common causes

- Actual SYN flood attack
- Traffic spike with small listen backlog
- Slow accept() loop in the application
- No CDN/rate limiting in front
- Low `tcp_max_syn_backlog`

## Quick fix

1. Keep `net.ipv4.tcp_syncookies=1`
2. Raise `somaxconn` and `tcp_max_syn_backlog`
3. Rate limit or move behind a CDN/WAF

## Detailed fix by platform

### Linux

1. 

```bash
sysctl net.ipv4.tcp_syncookies net.ipv4.tcp_max_syn_backlog net.core.somaxconn
netstat -s | grep -i "SYNs to LISTEN"
```


## How to diagnose

1. **Source** — Attack or spike?
2. **Backlog** — Large enough?
3. **SYN cookies** — On?

---
Source: [WhatIsMyError](https://whatismyerror.com/errors/networking/syn-flood-possible-syn-flooding-cookies)