advanced syncookie implementation


found in FreeBSD, Andre Oppermann

packs MSS, WSCALE, SACK and an odd/even secret marker into the ISN
but ISN is only 32 bits

table of most common MSS and WSCALE values
encode table index, 3 bits
no perfect match? next smaller
tiny performance loss (worst case)
analysis: MSS table covers 99.5% of all values seen in the wild
analysis: WSCALE table covers 95%


SACK and odd/even are 1 bit each