The backlog is modelled as a birth-death Markov chain: state n = number of occupied half-open slots, 0 ≤ n ≤ K. Arrivals (attack + legit SYNs, combined rate λ) push n → n+1 whenever n < K. Crucially, each occupied slot expires on its own independent clock — this is a bank of K parallel timers, not one shared server — so the total expiry rate in state n is n·μ, not a constant. That state-dependent death rate makes this a finite-server loss system, whose exact steady state is the same truncated-Poisson law Erlang derived for trunk-line blocking: the Erlang-B formula, not the geometric distribution of a single-server M/M/1/K queue.
λ = attack_rate + legit_rate
p = legit_rate / λ (legit share of arrivals)
1/μ = p·T_legit + (1-p)·T_timeout (mean slot holding time)
A = λ/μ (offered load, in Erlangs)
π(n) = A ⁿ⁄n! · π(0), π(0) chosen so Σπ(n) = 1 for n = 0..K (Erlang-B)
E[N] = Σ n·π(n) (predicted mean occupancy)
P_block = π(K) (predicted fraction of arrivals dropped, Erlang's loss formula)
The live 2D slot grid and the strip chart below it run an independent discrete-event simulation of the same process (real Poisson-style arrivals, real per-slot expiry clocks) — its measured occupancy is plotted as a solid line, the analytic E[N]/K from the formula above as a dashed reference line. They converge because they describe the same physics from two different directions: one draws individual packets, the other solves the steady-state balance equations directly.
SYN cookies remove the queue from the model entirely: the server never allocates a slot at SYN time, so K is irrelevant, predicted occupancy and blocking probability both collapse to zero, and legit success stays at 100% regardless of attack rate — only a cryptographically-valid ACK (which a spoofed attacker can never produce) completes a connection.
- Attack / Legitimate rate — the two Poisson-ish arrival streams that make up λ.
- Backlog capacity (K) — buffer size in the Markov chain; raising it lowers π(K) for the same λ, μ.
- Half-open timeout — dominates 1/μ once attack traffic exceeds legit traffic, since every attack slot is held for the full timeout (it never gets an ACK).
- Model vs measured gap — should shrink toward ~0 as the simulation runs longer (the discrete simulation is noisy over short windows, the analytic value is the exact steady state).