🌊

TCP SYN Flood & SYN Cookies

Complex

Free preview · 2 of 5 steps

TCP handshake state: the attack surface

TCP requires server-side state for every incoming connection. When the server receives a SYN, it must allocate a TCB (Transmission Control Block) in memory — even before the connection is complete. The server's SYN backlog queue has a maximum size.

A SYN flood exploits this: send millions of SYNs with spoofed source IPs so the SYN-ACKs go nowhere and half-open connections pile up until the queue is full.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step