Thwarting SYN flood DDOS attacks

A method for efficiently thwarting syn flood DDoS attacks, the method comprising:

• providing, in a network controller, hardware having packet a steering capability;
• providing a software application to create and to configure initial steering object/s which define a packet steering configuration of the network controller and monitor all opened connections, including updating the packet steering configuration each time a connection is established, wherein the software application's creation and configuration of said initial steering object/s includes the following operations:
• for TCP SYN/ACK packets, creating steering objects to look up a value over packet headers;
• for at least one packet having a header, creating steering objects to reverse the packet's header and to send the packet back to the packet's source;
• waiting for, and tracking, all incoming new connections;
• waiting for, and tracking, all stalled or closed connections;
• at least once, refreshing a created steering object to ensure randomness;
• and
• configuring at least one steering object/s for allowed established connections;
• and
• thwarting SYN flood DDoS attacks by computing a SYN cookie value used for said thwarting, without wasting target server CPU cycles on crypto hash calculation per SYN and ACK packets in real time, thus without devoting per-packet target server CPU effort thereto in real time, including using the steering capability to provide the SYN cookie value, and to at least one packet to the packet's source, rather than resorting to software to perform crypto hash calculation per SYN and ACK packets in real time.