Figure 10-2 Three-Way Handshake; Figure 10-3 Syn Flood - ZyXEL Communications 650 Series User Manual

Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the
receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the
initiator responds with an ACK (acknowledgment). After this handshake, a connection is established.
2-a SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a
backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an
internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once
the queue is full, the system will ignore all incoming SYN requests, making the system unavailable
for legitimate users.
Firewalls

Figure 10-2 Three-Way Handshake

Figure 10-3 SYN Flood

Prestige 650 series User's Guide
10-5