Counting syn packets

A method of counting synchronization (SYN) packets to identify a SYN attack, which is applicable to a network device,

• wherein the network device comprises a field programmable gate array (FPGA) for counting a total number of received SYN packets and a high-speed hardware memory connected to the FPGA;
• and
• the high-speed hardware memory is stored with a plurality of count entries corresponding to respective source internet protocol (IP) addresses in the received SYN packets, each of the count entries comprising a creation time when the count entry is created, a source IP address corresponding to the count entry, and a cumulative number of a part of the received SYN packets corresponding to the source IP address,
• the method comprising:
• periodically traversing the count entries stored in the high-speed hardware memory, and aging any one of the traversed count entries for which a time difference between a current time and the creation time reaches a preset aging time interval;
• obtaining a first number of SYN packets by cumulating the cumulative number in each of one or more of the count entries which is traversed in a current traversal period and for which the time difference between the current time and the creation time does not reach the preset aging time interval, and obtaining a second number of SYN packets by cumulating a value added to the cumulative number in each of the count entries during and after traversing the count entries in the current traversal period;
• and
• updating the total number of the received SYN packets counted by the FPGA with a sum of the first number of SYN packets and the second number of SYN packets.