This type of attack takes advantage of the three-way handshake that is used to establish a connection between two hosts, as can be seen in the following diagram:
It is called a SYN flood because a huge amount of connections are made simultaneously to the attacked host, these being the SYN seen in the diagram. In the host's attempt to establish these incoming connections, the host responds with a SYN/ACK packet. Typically, to complete the handshake, the sender will then respond with a further ACK packet; however, the sender does not send this final response. As a result, this leaves a huge amount of open connections on the host, resulting in a large number of resources being utilized unnecessarily. This then leaves minimal resources available to then process legitimate requests.
