thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

SYN Flood

A DoS attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table.

Definition

The server allocates resources for each half-open connection and waits for the final ACK that never arrives, often because source IPs are spoofed. Eventually it cannot accept legitimate connections. SYN cookies, reduced timeouts and firewall SYN proxies mitigate it.

Example

Thousands of SYN packets per second from spoofed IPs leaving a web server in SYN_RECEIVED states.

Exam tip

SYN cookies are the classic mitigation answer.

Related terms