TcpExtListenOverflows rose by 4,812 during a five-minute traffic burst. The kernel log mentioned a possible SYN flood, yet the packet capture showed ordinary clients completing handshakes. The counter proves that a listening socket could not admit another connection; it does not identify the cause by itself.
Linux keeps ...