The principle of DoS is to attack servers to degrade their capability with a lot of data packets. SYN Flood attack is an important way of DoS attack, which uses leaks to attack servers during TCP’s three-way handshake. The paper introduces the attack principle of SYN Flood and the implementation of SYN Cookie based on Linux 2.6 kernel. Finally, it proposes an improved method.