A normal connection between a user (Alice) and a server. The three-way handshake is correctly performed.

SYN Flood. The attacker (Bob) sends several packets but does not send the "ACK" back to the server. The connections are hence half-opened and eat the server resources. Alice, a legitimate user, tries to connect but the server refuses to open a connection resulting in a denial of service.

A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system. Image File history File links Tcp_normal. ... Image File history File links Tcp_normal. ... Image File history File links Download high-resolution version (657x825, 95 KB) Syn flooding : several connections set by the attacker are half-open without proper acknowledgments, the server queue gets full and another client can not connect Author : Dake Software : Inkscape Icons : Crystal Clear Category:Crystal_Clear_icons File links The following... Image File history File links Download high-resolution version (657x825, 95 KB) Syn flooding : several connections set by the attacker are half-open without proper acknowledgments, the server queue gets full and another client can not connect Author : Dake Software : Inkscape Icons : Crystal Clear Category:Crystal_Clear_icons File links The following... In computer security, a denial-of-service attack (DoS attack) is an attempt to make a computer resource unavailable to its intended users. ... SYN (synchronize) is a type of packet used by the Transmission Control Protocol (TCP) when initiating a new connection to synchronize the sequence numbers on two connecting computers. ...

When a client attempts to start a TCP connection to a server, the client and server exchange a series of messages which normally runs like this: The Transmission Control Protocol (TCP) is a virtual circuit protocol that is one of the core protocols of the Internet protocol suite, often simply referred to as TCP/IP. Using TCP, applications on networked hosts can create connections to one another, over which they can exchange streams of data. ... In computing, a client is a system that accesses a (remote) service on another computer by some kind of network. ... This article or section does not cite its references or sources. ...

1. The client requests a connection by sending a SYN (synchronize) message to the server.
2. The server acknowledges this request by sending SYN-ACK back to the client, which,
3. Responds with an ACK, and the connection is established.

This is called the TCP three-way handshake, and is the foundation for every connection established using the TCP protocol. It has been suggested that SYN (TCP) be merged into this article or section. ... The Transmission Control Protocol (TCP) is a virtual circuit protocol that is one of the core protocols of the Internet protocol suite, often simply referred to as TCP/IP. Using TCP, applications on networked hosts can create connections to one another, over which they can exchange streams of data. ...

This is a well known type of attack and is generally not effective against modern networks

. It works if a server allocates resources after receiving a SYN, but before it has received the ACK.

There are two methods, but both involve the server not receiving the ACK. A malicious client can skip sending this last ACK message. Or by spoofing the source IP address in the SYN, the server sends the SYN-ACK to the falsified IP address, and never receives the ACK. In both cases the server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing ACK. In computer networking, the term Internet Protocol address spoofing is the creation of IP packets with a forged (spoofed) source IP address. ... An IP address (Internet Protocol address) is a unique address that devices use in order to identify and communicate with each other on a computer network utilizing the Internet Protocol standard (IP)—in simpler terms, a computer address. ...

If these half-open connections bind resources on the server, it may be possible to take up all these resources by flooding the server with SYN messages. Once all resources set aside for half-open connections are reserved, no new connections (legitimate or not) can be made, resulting in denial of service. Some systems may malfunction badly or even crash if other operating system functions are starved of resources this way. This page meets Wikipedias criteria for speedy deletion. ...

Reflector routers can also be used as attackers, instead of client machines.

Countermeasures include SYN cookies or limiting the number of new connections from a source per timeframe. SYN Cookies are the key element of a technique used to guard against SYN flood attacks. ...

External link

• Official CERT advisory on SYN Attacks