A SYN flood attack is a denial-of-service technique that targets availability by overwhelming a system with TCP connection-opening requests. The target answers each SYN with SYN-ACK and reserves a connection-table entry, but the final ACK never arrives. section 11.2.1
The attack proceeds through a characteristic sequence:
- Flood the target with SYN messages. section 11.2.1
- Cause the target to send SYN-ACK replies and record each pending connection. section 11.2.1
- Leave the connections half open by withholding the final ACK. section 11.2.1
- Exhaust the connection table so legitimate users cannot establish TCP connections. section 11.2.1
Spoofed-source SYN flood
An attacker can spoof the source IP address, causing SYN-ACK replies to go elsewhere while the target retains the half-open connection state. When many infected devices participate, the attack becomes a distributed denial-of-service attack using a botnet. section 11.2.1
Figure 11.2 A TCP SYN flood attack—an example of a DoS attack. (1) The target is flooded with SYN messages and (2) replies with SYN-ACK messages. (3) The half-open TCP connections prevent the target from accepting legitimate TCP connections.
The figure traces the SYN, SYN-ACK, and missing-ACK sequence and shows how half-open connections block legitimate TCP connections. section 11.2.1
