When in a single session, SYN flood works differently based on different SRX platforms. High-end platforms (SRX5000, SRX1400, SRX3000) will trigger SYN flood as expected while software based platforms (branch-SRX, SRX4000, SRX1500) will not trigger SYN flood.

Configuration:

  set security screen ids-option TEST tcp syn-flood attack-threshold 100000
  set security screen ids-option TEST tcp syn-flood source-threshold 100000
  set security screen ids-option TEST tcp syn-flood destination-threshold 500
  set security policies from-zone SCREEN to-zone SCREEN policy SCREEN-P match source-address any
  set security policies from-zone SCREEN to-zone SCREEN policy SCREEN-P match destination-address any
  set security policies from-zone SCREEN to-zone SCREEN policy SCREEN-P match application any
  set security policies from-zone SCREEN to-zone SCREEN policy SCREEN-P then permit
  set security zones security-zone SCREEN screen TEST
  set security zones security-zone SCREEN host-inbound-traffic system-services all
  set security zones security-zone SCREEN interfaces reth0.102
  set security zones security-zone SCREEN interfaces reth0.103

SRX4100:

root@jtac-srx4100-r2006> show security screen ids-option TEST
  node0:
  ----------------------------------------------------
  Screen object status:

  Name                                         Value
    TCP SYN flood attack threshold             100000
    TCP SYN flood alarm threshold              512
    TCP SYN flood source threshold             100000
    TCP SYN flood destination threshold        500
    TCP SYN flood timeout                      20


  root@jtac-srx4100-r2006> show interfaces reth0 | match pps
    Input rate     : 1316800 bps (1824 pps)
    Output rate    : 1023936 bps (912 pps)

  {primary:node0}
  root@jtac-srx4100-r2006> show security screen statistics zone SCREEN | match SYN
    TCP SYN flood                              0
        SYN flood source                       0
        SYN flood destination                  0
    TCP SYN fragment                           0
    TCP SYN FIN                                0
    TCP SYN-ACK-ACK proxy                      0
    TCP SYN flood                              0
        SYN flood source                       0
        SYN flood destination                  0
    TCP SYN fragment                           0
    TCP SYN FIN                                0
    TCP SYN-ACK-ACK proxy                      0

SRX5600:

In SRX5600, the screen works under the same configuration and traffic.

root@srx5600-r2011> show interfaces ge-1/0/1 | grep pps
    Input rate     : 1195680 bps (1437 pps)
    Output rate    : 646480 bps (511 pps)

  {primary:node0}
  root@srx5600-r2011> show security screen statistics zone TRUST | grep SYN
    TCP SYN flood                              30942
        SYN flood source                       0
        SYN flood destination                  30942
    TCP SYN fragment                           0
    TCP SYN FIN                                0
    TCP SYN-ACK-ACK proxy                      0
    TCP SYN flood                              0
        SYN flood source                       0
        SYN flood destination                  0
    TCP SYN fragment                           0
    TCP SYN FIN                                0
    TCP SYN-ACK-ACK proxy                      0

This behavior is by design. For all software based platforms (branch-SRX, SRX4000, SRX1500), the SYN flood feature is checked in flow First-Path (first packet for session creation). Thus, one single session will not trigger SYN flood.

For high-end platforms (SRX5000, SRX1400, SRX3000), the SYN flood feature is executed in NP hardware. It will check the SYN every time. It is not based on the session.