If you get a SYN flood that eats the entire bandwidth of the pipe then your problem is a bandwidth problem more than just too many potentially zombied TCP connections.
Im sure the CSS cannot handle 200-300K SYNs per second and even if it did there would be no room in the pipe for any legitimate traffic.
The CSS does protect against SYN floods by terminating any TCP connection that does not include a frame with the ACK bit set after the SYN from the initiator of the connection. This occurs within 15 seconds of the initial SYN being received. In that 15 second time period a burst as large as what you are describing would eat all available flows and the sustained rate would not allow CSS to reclaim them fast enough.
I think I read somewhere there are on the order of 100K flows available per session processor. This gives us a maximum of 400K flows per fully loaded CSS 11800 with the currently shipping software and memory configuration. If you divide this number by 15 seconds you will get the maximum sustained rate CSS could protect against. Also, the 15-second timeout is not configurable.
The CSS had built in DOS prevention for a range of well known attacks. For SYN floods, it will ack the initial SYN but will drop any flows that do not reposnf to the SYN-ACK, after 16 seconds. If the CSS receives 8 consecutive SYNs that are not acked from the same source address, it will not set up any more flows from that source - i.e it will not even respond to the initial SYN request. This is for flow managment only though and will not prevent your bandwidth from being chewed up by the inbound SYNs
Introduction This article will help you understand the steps on how to
download the UCS licenses from the Cisco Systems website and then
installing it on the UCS. The redacted (blue lines) just covers up
certain numbers for privacy please do not take them...
Introduction This article will help you understand and educate the
customer on how to clear their "expired licenses"
(license-graceperiod-expired) from their UCS-M. If a customer just
purchased a license and needs a step by step guide on how to download
Introduction Prepositioning is a powerful tools on the WAAS platform but
it is not always easy to figure out why your jobs are failing when
trying to retrieve the files.Here is a method that should help you to
figure out the reason why they are not succes...