SYN cookies answer when the queue overflows
A Linux TCP listener distinguishes pending handshake requests from established connections waiting for accept(). These are commonly called the SYN queue and accept queue. Their capacity limits and overflow paths differ, so diagnosing a connection failure requires identifying which stage is under pressure. ...