A SYN Flood attack is a specific type of DDoS (Distributed Denial of Service) attack aimed at overwhelming the resources of a target computer, service, or network. The term "SYN" refers to the SYNchronization bit in TCP/IP communication, used for establishing a connection between a client and a server.
In a SYN Flood attack, the attacker sends a large number of SYN requests (Synchronization requests) to the target system but never completes the connection by sending the corresponding ACK responses (Acknowledgement) to the SYN-ACK packets (Synchronization-Acknowledgement) from the target system. The target system then waits for the final acknowledgment and reserves resources for these open connections. However, since the attacker doesn't send final acknowledgments, these connections remain open and consume resources on the target system. When enough open connections are generated, the resources of the target system are depleted, leading to a denial of service and making it inaccessible to legitimate users.
A SYN Flood attack exploits the way the TCP/IP protocol operates and is one of the most common techniques used in DDoS attacks. Countermeasures such as SYN cookies and SYN proxying can help mitigate the effects of SYN Flood attacks.
