Figure 46 Three-Way Handshake - Nortel BSR252 Configuration - Basics

158 Chapter 10 Firewalls
2

Figure 46 Three-way handshake

Under normal circumstances, the application that initiates a session sends a SYN
(synchronize) packet to the receiving server. The receiver sends back an ACK
(acknowledgment) packet and its own SYN, and then the initiator responds with
an ACK (acknowledgment). After this handshake, a connection is established.
SYN Attack floods a targeted system with a series of SYN packets. Each packet
causes the targeted system to issue a SYN-ACK response. While the targeted
system waits for the ACK that follows the SYN-ACK, it queues up all outstanding
SYN-ACK responses on what is known as a backlog queue. SYN-ACKs are
moved off the queue only when an ACK comes back or when an internal timer
(which is set at relatively long intervals) terminates the three-way handshake.
Once the queue is full, the system ignores all incoming SYN requests, making the
system unavailable for legitimate users.
NN47923-500
Weaknesses in the TCP/IP specification leave it open to SYN Flood and
LAND attacks. These attacks are executed during the handshake that initiates
a communication session between two applications.