Definition
A SYN flood is a type of denial of service DoS attack that exploits the Transmission Control Protocol TCP three-way handshake. The attacker sends a flood of TCP SYN packets to a target server, often with spoofed source IP addresses. The server responds to each SYN packet with a SYN ACK and allocates resources to track the connection, but the spoofed source IPs never complete the handshake by sending the final ACK. This exhausts the server's connection table, preventing legitimate users from establishing new connections. Understanding SYN floods is crucial for network administrators and security professionals designing resilient systems. For example, a large-scale SYN flood could disrupt access to a popular e-commerce website during a major sale. Unlike a UDP flood which targets connectionless protocols, a SYN flood specifically targets the stateful nature of TCP connections. This attack vector is a common topic on security certifications like CompTIA Security+ and CISSP.