If you get a SYN flood that eats the entire bandwidth of the pipe then your problem is a bandwidth problem more than just too many potentially zombied TCP connections.
I’m sure the CSS cannot handle 200-300K SYNs per second and even if it did there would be no room in the pipe for any legitimate traffic.
The CSS does protect against SYN floods by terminating any TCP connection that does not include a frame with the ACK bit set after the SYN from the initiator of the connection. This occurs within 15 seconds of the initial SYN being received. In that 15 second time period a burst as large as what you are describing would eat all available flows and the sustained rate would not allow CSS to reclaim them fast enough.
I think I read somewhere there are on the order of 100K flows available per session processor. This gives us a maximum of 400K flows per fully loaded CSS 11800 with the currently shipping software and memory configuration. If you divide this number by 15 seconds you will get the maximum sustained rate CSS could protect against. Also, the 15-second timeout is not configurable.
Hope this helps!
