Figure 13-2 Three-Way Handshake; Figure 13-3 Syn Flood - ZyXEL Communications ZyXEL ZyWALL 2WE User Manual

Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the
receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the
initiator responds with an ACK (acknowledgment). After this handshake, a connection is established.
2-a SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that
follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a
backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an
internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once
the queue is full, the system will ignore all incoming SYN requests, making the system unavailable
for legitimate users.
Firewalls

Figure 13-2 Three-Way Handshake

Figure 13-3 SYN Flood

ZyWALL 2 and ZyWALL 2WE
13-5