01
Normal TCP handshake
Client sends SYN. Server replies SYN-ACK and reserves state. Client completes with ACK - connection established.
Each half-open SYN-ACK waits for a timeout if the final ACK never arrives.
Attack vectors
Half-open connections can fill tables faster than you think.
A SYN flood sends massive volumes of TCP SYN packets without completing the three-way handshake. The target allocates state for each SYN until memory and connection tables are exhausted.
5 min read
02
How the attack works
Attackers spoof source IPs or use botnets to send SYN packets. The server responds with SYN-ACK to forged addresses, leaving half-open entries.
Even high-performance servers and load balancers can degrade when the SYN queue fills - legitimate users see timeouts.
03
Mitigation techniques
SYN cookies: encode state in the SYN-ACK sequence number instead of storing it - Linux supports this natively.
Edge scrubbing drops abnormal SYN rates before they hit origin. Rate limits per source /24 and challenge mechanisms on L7 reverse proxies complement L4 filtering.
SYN flood FAQ
Is a SYN flood Layer 4 or Layer 7?
SYN floods are Layer 4 (transport) because they abuse TCP mechanics, even if targeting port 443.
Can a CDN stop SYN floods?
A CDN protects HTTP after TCP is established. Large SYN floods still need network-layer scrubbing or SYN cookies at origin.
Stop SYN floods at the edge
TMW Shield detects abnormal SYN rates within seconds and filters before your router's connection table saturates.