Hacker News Reader

It clearly states that it's for TCP based attacks. TCP attacks eg. SYN floods is a real problem and this does help against most such attacks.

Just as real as anything else...

View on HN

only for DoS, not DDoS. i.e. if you omit the distributed from Denial of Service, then iptables will work. Not so when the attack exhausts either your bandwidth or your stack's filtering capabilities. it's easy to rent GBits of distributed attack bandwidth.

Most modern Unixes have syn cookies. You do not necessarily need anything else.

You still have to do some tuning and at least assign RX queues properly.

You want to drop unwanted traffic before you start spending more cycles on it.

Reply on news.ycombinator.com