Abstract: Methods and systems for synchronizing state information amongst monitoring nodes for DDoS attack mitigation are disclosed. Embodiments of the present technology may include a method for synchronizing state information amongst monitoring nodes, the method including identifying a packet as a state-related packet by inspecting the packet below a TCP/IP stack in a monitoring node and implementing state synchronization operations below the TCP/IP stack of the monitoring node in response to identifying the packet as a state-related packet, wherein the state synchronization operations include updating an allowlist stored as a key-value map in the monitoring node based on the identified packet and generating a state update packet based on the identified packet.