i have read about SYN cookies and i understood that they help to avoid DOS .. BUt my prof wants an answer as how SYN cookies can be used to cause DOS and how can it be avoided ? any help woul dbe really appreciated.. thanks in advance
Computing syncookies requires taking a hash of the server and client's IPs and ports... These hashes may not be inexpensive esp if they are to be cryptographically secure. One way to DOS the syncookie code is to make so many requests that the CPU of the server is exhausted. I believe that Linux uses a less expensive (and not cryptographically secure) hash function, so this is less of an issue.
You could probably also spoof sender IP and use syncookies to be sent to a victim. But that is not that useful/ interesting.