Synchronize
TCP SYN (Synchronize, bit 6) initiates a TCP connection. SYN is set only in the first and second packets of the three-way handshake: the client's initial SYN and the server's SYN-ACK. A SYN synchronizes sequence numbers between the two endpoints and cannot carry application data in the initial segment.
Abbreviation
SYN
Bit Position
6
tcpdump
[S]
Standard
RFC 9293
Description
SYN is the connection establishment flag. The three-way handshake uses it as follows: client sends SYN with its Initial Sequence Number (ISN), server responds with SYN+ACK containing its own ISN and acknowledging the client's ISN+1, client sends ACK acknowledging the server's ISN+1. After this exchange, both sides know each other's sequence numbers and the connection is established.
The ISN is chosen randomly (RFC 9293 §3.4.1) to prevent sequence number prediction attacks. A predictable ISN would allow an attacker to inject data into a TCP session by guessing the current sequence number.
SYN flood attacks exploit the handshake: an attacker sends many SYNs with spoofed source IPs. The server allocates a TCB (Transmission Control Block) for each and sends SYN-ACKs, but never receives ACKs. SYN cookies (RFC 4987) defend against this by encoding state in the ISN instead of allocating memory until the handshake completes.
Key Flag Combinations
| Flags | Meaning |
|---|---|
| SYN | Client initiating connection – first step of three-way handshake |
| SYN+ACK | Server accepting connection – second step of handshake |
| SYN+ECE+CWR | Client initiating connection with ECN capability request |
| SYN+RST | Invalid combination – indicates malformed or malicious packet |
When You See This Flag
- –Application calling connect() – client initiates three-way handshake
- –Server responding to incoming SYN with SYN+ACK
- –SYN flood attack: many SYNs with spoofed source IPs
- –Port scanner probing for open TCP ports