Skip to main content
protocols.pageprotocols.page
networking

SYN (Synchronize)

SYN is a TCP flag used to initiate a connection via the three-way handshake: SYN, SYN-ACK, ACK. The SYN packet carries the client's initial sequence number (ISN). SYN floods are a classic DDoS attack that exhausts server connection tables by sending SYNs without completing handshakes.

Definition

The SYN flag initiates TCP connection establishment. The client sends a SYN packet with its Initial Sequence Number (ISN) – a randomized 32-bit value that prevents sequence prediction attacks. The server responds with SYN-ACK (its own ISN + acknowledgment of the client's ISN). The client completes with ACK. This three-way handshake costs 1 RTT before data can flow. SYN flood attacks send millions of SYN packets with spoofed source IPs. The server allocates a half-open connection entry for each SYN, exhausting its connection table. SYN cookies (RFC 4987) defend against this by encoding connection state in the ISN itself – no state is stored until the handshake completes. Linux enables SYN cookies automatically when the SYN backlog fills (tcp_syncookies=1).

Examples

  • –hping3 -S -p 80 --flood target – SYN flood (for authorized testing only)
  • –ss -s shows SYN-RECV state count (half-open connections)
  • –sysctl net.ipv4.tcp_syncookies=1 enables SYN cookie defense

Related Protocols

tcp

Related Terms

ACK (Acknowledgment)

ACK (acknowledgment) is a TCP flag confirming receipt of data. The ACK number indicates the next byte the receiver expects. Delayed ACKs batch confirmations for efficiency (typically every 2 segments or 200ms). Missing ACKs trigger retransmission – the sender assumes data was lost.

FIN (Finish)

FIN is a TCP flag used to gracefully close a connection. TCP close is a four-way process: FIN from initiator, ACK from peer, FIN from peer, ACK from initiator. The TIME_WAIT state after closing lasts 2*MSL (typically 60s) to handle delayed packets – this can exhaust ports on busy servers.

Three-Way Handshake

The TCP three-way handshake (SYN, SYN-ACK, ACK) establishes a connection between client and server. It synchronizes sequence numbers, negotiates options (MSS, window scale, SACK, timestamps), and costs exactly 1 RTT before data can flow. TLS adds 1-2 more RTTs on top.