documentation_complete: true

title: 'Configure Kernel Parameter to Use TCP Syncookies'

description: '<sysctl-desc-macro sysctl="net.ipv4.tcp_syncookies" value="1" />'

rationale: |-
    A TCP SYN flood attack can cause a denial of service by filling a
    system's TCP connection table with connections in the SYN_RCVD state.
    Syncookies can be used to track a connection when a subsequent ACK is received,
    verifying the initiator is attempting a valid connection and is not a flood
    source. This feature is activated when a flood condition is detected, and
    enables the system to continue servicing valid connection requests.

severity: medium

identifiers:
    cce: 27053-8

references:
    disa: '1092, 1095'
    nist: AC-4,SC-5(2),SC-5(3)
    srg: SRG-OS-000142
    stigid: RHEL-06-000095

ocil: '<sysctl-check-macro sysctl="net.ipv4.tcp_syncookies" value="1" />'
