[ale] stunnel fails and emits SYN flooding messages

[Allan Metts]

We're experiencing intermittent failures with our servers running stunnel on Amazon EC2.  When the failure occurs, stunnel continues attempts to authenticate the certificate, but no longer allows connections.

A review of /var/log/messages shows the following messages once each minute, beginning at the time of failure (these message occur less frequently at other times as well):

  kernel: possible SYN flooding on port 443. Sending cookies.

Also notable is the fact that stunnel seems to be consuming most of the system memory at this point (over 2GB, 78%).  Sockstat shows several thousand activate connections (which is in-line with our typical usage), but does not seem to be showing any that are stranded.

Can anyone suggest what might be happening?  Any recommended remedies?

Thanks in advance,
Allan