SYN Flood

In a SYN flood, the attacker opens — but never finishes — large numbers of TCP connections. Each spoofed or unanswered SYN forces the server to allocate a half-open connection in its backlog queue and reply with SYN/ACK, awaiting a final ACK that never arrives. When the backlog fills, the server refuses new legitimate connections. SYN floods can come from a single host or, more commonly, a botnet, with source IPs spoofed to make filtering harder. Mitigations include SYN cookies (which eliminate per-half-open state), larger or dynamically sized SYN queues, connection-rate limiting at firewalls and load balancers, stateless filtering at the network edge, and upstream DDoS scrubbing.