SYN Attack

• When the initiator responds with a final ACK the connection transitions from half open to completely open

• Most TCP/IP stacks only support a small number of half open connections (default is 5!)

• SYN attacker sends a SYN but forges the IP packet return address

• No ACK every comes