Figure 10-2 Three-Way Handshake; Figure 10-3 Syn Flood - ZyXEL Communications ZYWALL2 ET 2WE User Manual

Under normal circumstances, the application that initiates a session sends a SYN (synchronize)
packet to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN,
and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is
established.
2-a SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a
backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an
internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once
the queue is full, the system will ignore all incoming SYN requests, making the system unavailable
for legitimate users.
Firewalls

Figure 10-2 Three-Way Handshake

Figure 10-3 SYN Flood

ZyWALL 2 Series User's Guide
10-5