TCP SYN cookies are always turned on when enabled?

Solution 1:

The second source

"this means that options such as selective ACKs and TCP Window Scaling won't work if you turn on SYN Cookies, even if your server isn't currently under attack"

is simply bullshit, until

"TCP: request_sock_TCP: Possible SYN flooding on port 53. Sending cookies. Check SNMP counters"

happens there is nothing disabled.

This is easy provable by comparing your performance with iperf3 and enabling/disabling "net.ipv4.tcp_sack" and "net.ipv4.tcp_window_scaling" while keep "net.ipv4.tcp_syncookies = 1" enabled.

Why do you read random sources instead the official ones? https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt

tcp_syncookies - BOOLEAN
    Only valid when the kernel was compiled with CONFIG_SYN_COOKIES
    Send out syncookies when the syn backlog queue of a socket
    overflows. This is to prevent against the common 'SYN flood attack'
    Default: 1

    Note, that syncookies is fallback facility.
    It MUST NOT be used to help highly loaded servers to stand
    against legal connection rate. If you see SYN flood warnings
    in your logs, but investigation shows that they occur
    because of overload with legal connections, you should tune
    another parameters until this warning disappear.
    See: tcp_max_syn_backlog, tcp_synack_retries, tcp_abort_on_overflow.

    syncookies seriously violate TCP protocol, do not allow
    to use TCP extensions, can result in serious degradation
    of some services (f.e. SMTP relaying), visible not by you,
    but your clients and relays, contacting you. While you see
    SYN flood warnings in logs not being really flooded, your server
    is seriously misconfigured.