Which attack creates numerous half-open TCP connections by sending initial SYNs and not completing the handshake?

Which attack creates numerous half-open TCP connections by sending initial SYNs and not completing the handshake?

• A. ACK and PUSH ACK Flood Attack
• B. HTTP GET Attack
• C. SYN Flood Attack
• D. SYN-ACK Flood Attack

Answer: (D)

This type of attack exploits TCP’s three‑way handshake to tie up server resources. A normal connection starts with a SYN, the server replies with a SYN-ACK, and the client completes the handshake with an ACK. In a SYN flood, the attacker bombards the server with a flood of SYN packets. For each one, the server allocates an entry in its connection backlog and waits for the final ACK that never arrives. Because many handshakes are left incomplete, the backlog fills up with half-open connections, preventing legitimate clients from establishing new ones. That behavior is the defining trait of a SYN flood attack.

This type of attack exploits TCP’s three‑way handshake to tie up server resources. A normal connection starts with a SYN, the server replies with a SYN-ACK, and the client completes the handshake with an ACK. In a SYN flood, the attacker bombards the server with a flood of SYN packets. For each one, the server allocates an entry in its connection backlog and waits for the final ACK that never arrives. Because many handshakes are left incomplete, the backlog fills up with half-open connections, preventing legitimate clients from establishing new ones. That behavior is the defining trait of a SYN flood attack.