SYN Flood

A SYN flood is a DDoS technique that abuses the TCP three-way handshake. The attacker sends a stream of SYN packets, often with spoofed source addresses, so the server keeps waiting for final ACKs that never arrive.

Why it matters

Each half-open connection occupies a slot in the server's backlog. When the queue fills, legitimate clients cannot connect and the service appears down even though bandwidth is barely used. Defenses include SYN cookies, which avoid storing state until the handshake completes, larger backlogs, firewall rate limits and upstream DDoS mitigation.

Example

$ ss -n state syn-recv | wc -l
48210

Tens of thousands of connections stuck in SYN-RECV on a normal web server are a typical sign of an attack. On Linux, net.ipv4.tcp_syncookies=1 enables SYN cookies.

Common mistakes

• Assuming only bandwidth-heavy attacks cause outages. SYN floods can succeed with little traffic.
• Blocking source addresses one by one when they are spoofed and constantly changing.
• Disabling SYN cookies or timeouts without understanding the trade-offs.

Related

• TCP
• DDoS
• Rate limiting
• Firewall

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.