Agreed. For the large SYN floods (X Mpps hitting a single machine) syncookie solutions don't work. What works is identifying the SYN flood itself and filtering it.
Many hardware load balancers can do +100M SYN cookies per second (assuming a proxy/gateway deployment instead of DSR).
So SYN cookie solutions do work; they just don't work great on stock Linux.
Edit: Add clarification about LB deployment. Won't work with DSR.
Agreed. We use Solarflare cards but we don't syncookie when we get a large flood. We identify the flood and drop it. There's little point firing back millions of useless SYN ACKs per second.
How do you know what to drop without SYN cookies? If the attacker isn't advanced, sure all the SYN's will look the same. What if the attacker is smart and the SYN's look legit and are spoofed? If you drop those SYN's, you'll run the risk of also dropping legit traffic if you don't use cookies.