SYN flooding is a type of DOS attack that makes the service unavailable for legitimate users. A SYN flood attack makes use of the TCP protocol's three-way handshake, where a client sends a TCP SYN packet to start a connection to the server, and the server replies with a TCP SYN-ACK packet. Then, in a normal operation, the client will send an ACK packet followed by the data. This will keep the connection open with a SYN_RECV state. But, if the client does not respond with an ACK packet, the connection will be in a half-opened state.
If multiple attackers or systems opened many such half-opened connections to the target server, it could fill the server's SYN buffer and may stop it receiving more SYN packets to cause a Denial-of-Service (DoS) attack:
We can generate SYN flood packets with Scapy for the testing.
