User's Manual

364
SYN Flood
A standard TCP connection needs to experience three hand-shake processes. A client sends the SYN
message to a server, the server returns the SYN-ACK message, and the client sends the ACK message to the
server after receiving the SYN-ACK message. In this way, a TCP connection is established. SYN flood triggers
the DoS attack when the TCP protocol stack initializes the hand-shake procedure between two hosts.