A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target’s system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic

The goal from this attack is make the server overload with incoming SYN request with no ACK.

Three way handshake normally runs like this:

  1. The client requests a connection by sending a SYN (synchronize) message to the server.
  2. The server acknowledges this request by sending SYN-ACK back to the client.
  3. The client responds with an ACK, and the connection is established.


This attack use this opportunity by act as friendly user that want to access the server but flooding only syn, not reply the syn-ack


There are a number of well-known countermeasures listed in RFC 4987 including:

  1. Filtering
  2. Increasing Backlog
  3. Reducing SYN-RECEIVED Timer
  4. Recycling the Oldest Half-Open TCP
  5. SYN Cache
  6. SYN cookies
  7. Hybrid Approaches
  8. Firewalls and Proxies


source :https://en.wikipedia.org/wiki/SYN_flood