SYN flood

In short: In a SYN flood an attacker sends very many connection requests (SYN) without ever completing the handshake, until the server can accept no new connections.

In more detail: It exploits the three-way handshake of TCP. For every SYN the server reserves memory for a half-open connection and waits in vain for the final ACK.

In Depth

• Effect: The queue of half-open connections fills up. Real users get no connection. It is a case of DDoS.
• Forged senders: Source addresses are often invented, so replies go nowhere.
• SYN cookies: The server initially stores nothing but encodes the state in the sequence number of its reply. Only a valid ACK creates a connection. Default in Linux (net.ipv4.tcp_syncookies=1).
• Other measures: Larger queues, shorter timeouts, rate limiting at firewall and router, filtering at the network edge, DDoS protection services.
• Spotting: Many connections in state SYN_RECV (ss -tan state syn-recv).

See also: man-in-the-middle and DDoS