[phw]

If the SYN queue is more than half full, the kernel (used to?) adapts the number of SYN/ACK retransmissions to mitigate the load. Interestingly, this opens a side channel that can be determined remotely, and used to measure packet filtering world-wide. See Section 2.1 in: https://censorbib.nymity.ch/pdf/Ensafi2015a.pdf

[majke]

I'm quite sure this was removed in recent kernels, the "young" logic is now greatly simplified. Anyway - great paper. Thanks for digging it up.