Figure 8-2 Three-Way Handshake; Figure 8-3 Syn Flood - ZyXEL Communications Prestige 792H User Manual

Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the
receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the
initiator responds with an ACK (acknowledgment). After this handshake, a connection is established.
2-a SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the targeted
system to issue a SYN-ACK response. While the targeted system waits for the ACK that follows the
SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a backlog queue.
SYN-ACKs are moved off the queue only when an ACK comes back or when an internal timer (which is
set at relatively long intervals) terminates the three-way handshake. Once the queue is full, the system
will ignore all incoming SYN requests, making the system unavailable for legitimate users.
Firewall

Figure 8-2 Three-Way Handshake

Figure 8-3 SYN Flood

Prestige 792H User's Guide
8-5