I understand the reason behind syn cookies is to defend the server against DoS through syn flooding by syn requests from spoofed IP addresses.
I also understand that its feature is that it doesn't have to store the syn and syn-ack numbers in the flowable.
However I don't quite understand the maths behind it. I read about the 32-bit sequence number consisting of t, m ,and Enc(k) but I do not understand where those components come from and how is this sequence computed and why does it work and how is then the client verified.
