What is a TCP SYN Flood attack?
The SYN Flood is one of the oldest and most effective denial-of-service (DDoS) attacks. It abuses TCP's three-way handshake: the attacker floods the target with SYN packets using a spoofed source address, the server replies with SYN-ACK and reserves resources waiting for an ACK that never arrives. As thousands of half-open connections pile up, the connection table saturates and the server stops accepting legitimate traffic.
How does it work step by step?
The attacker crafts SYN packets with a spoofed source IP so the SYN-ACK replies are lost or hit third-party victims. Each half-open connection consumes memory in the operating system's backlog queue. Without defenses, a few thousand packets per second are enough to exhaust that queue and take the service down, even from a single machine with modest bandwidth.
How to mitigate a SYN Flood?
Classic defenses are SYN cookies (the server holds no state until the handshake completes), a larger backlog, shorter half-open timeouts, and filtering with firewalls and rate limiting. At high volumes you need an edge anti-DDoS (scrubbing) service that absorbs and cleans the traffic before it reaches the origin.
