SYN Flood vs SYN Cookies

This simulator renders a TCP server's connection backlog as a live 3D queue of slots orbiting a central server node. Streams of legitimate and spoofed-attack SYN packets fly in continuously; in classic mode every SYN — real or forged — claims a backlog slot until it either completes the handshake or times out, so a fast enough flood exhausts the queue and starts silently dropping real users' connections. Flip on SYN cookies and the server stops storing any per-SYN state at all: it answers with a cryptographically derived sequence number instead of a reservation, so spoofed attack traffic is absorbed for free while legitimate clients still connect normally, with the backlog occupancy readout dropping to zero regardless of attack volume.