The other day I learnt that enabling syncookies in pf on OpenBSD lights up your server like a Christmas tree. Or in other words, it made the server respond to _every_ incoming tcp syn packet with syn/ack, making the bots scanning the internet think the port was open, even though the final ack would be dropped when rules were then evaluated. This increased scanning by a lot! Or so it seemed to me at least.

The reason for this experimentation was I got to experience what I think was a tiny syn-flood attack, and I was trying things to see what I could do to mitigate on my end.

I'll maybe write more about this after the holidays.