One of the most common DDOS attacks targeting hosts running TCP operations and exploiting the normal three-way handshake process.
Communication between the client and the server begins after a default connection is established. The client initiates a connection by sending SYN requests to the server, and then the server responds by sending SYN / ACK.
SYN / ACK is acknowledgment of the initial SYN request from the customer. The client responds with an ACK, to complete the connection to initiate the connection.
In a DDOS environment, malicious actor spoofs the Client and begins sending a large number of SYN requests from random IP addresses to the target server.
The server responds, assuming that they are legitimate requests with SYN / ACK, but does not permanently receive the ACK, thus linking server resources with semi-open TCP sessions which ultimately rejects legitimate connection requests.
