SYN flood

Common card · No. 498171

SYN flooding (or TCP SYN flood) is a form of denial-of-service attack against systems that provide services over the Transmission Control Protocol (TCP). It exploits the way many TCP implementations handle incoming connection requests by causing a server to retain state for large numbers of incomplete (or “half-open”) connections, leaving insufficient resources to accept new legitimate connections. The attack typically targets a TCP service in the LISTEN state (such as a web or mail server). An attacker sends a rapid stream of TCP SYN packets—often using spoofed source IP addresses—so that the server replies with SYN-ACK packets and allocates resources for each pending connection, but does not receive the final ACK needed to complete the TCP three-way handshake. If enough such requests are received, the server's backlog of pending connections can be exhausted, causing legitimate connection attempts to be delayed or rejected. SYN flooding was publicly described in 1996, although some sources...

Read on Wikipedia · Image Tcp_normal.png: Dake derivative work: Rehua (talk), CC BY-SA 3.0