TCP SYN Flooding Defense

The TCP SYN ooding denial-of-service attack pointed out a weakness of then-current Internet protocols. There have since been many proposals to defend against SYN ooding, some requiring signiicant changes to TCP. Several solutions attempting to resolve the TCP weakness are now generally available. We document these existing solutions and qualitatively compare them. We reene the analysis of the random drop approach and derive a simple and general way to improve its performance. Finally we show, through both analytical and packet-level simulations, the ee-cacy of the random drop approach in a variety of operating conditions.