Not later than yesterday I was explaining why syncookies on Linux aren't fast - you can't send more than say 300k pps of syn cookies for a single socket.

This patch seem to fix that. I wonder if this patch is merged yet.