This is excellent. I never thought about it that way. Indeed, with syn cookies the receiving party has no idea what was the original sequence number, so it will treat _any_ delivered packet as first.
Couple of caveats:
- you can jam syn cookies enabled with tcp_syncookies=2 sysctl
- syn cookies are generally bad because they prevent to negotiate window scaling. Window scaling is important unless you are doing low bandwidth like telnet :)
- you can somewhat negotiate window scaling when tcp timestamps are enabled. But enabling tcp timestamps in general case brings little benefit and wastes 12 bytes of each packet for basically no gain.
- for a bonus point, consider what happens when both syn cookies and TCP_DEFER_ACCEPT are enabled.
Couple of caveats:
- you can jam syn cookies enabled with tcp_syncookies=2 sysctl
- syn cookies are generally bad because they prevent to negotiate window scaling. Window scaling is important unless you are doing low bandwidth like telnet :)
- you can somewhat negotiate window scaling when tcp timestamps are enabled. But enabling tcp timestamps in general case brings little benefit and wastes 12 bytes of each packet for basically no gain.
- for a bonus point, consider what happens when both syn cookies and TCP_DEFER_ACCEPT are enabled.
More about syn packet handling in linux https://blog.cloudflare.com/syn-packet-handling-in-the-wild/