TCP SYN Flood Lifecycle 12 Steps

3-way TCP handshake, half-open SYN backlog exhaustion, cryptographic SYN cookies, and edge mitigation

Step 1 of 12

LEGITIMATE CLIENT

192.168.1.10

TCP Socket FSM SYN_SENT

Seq / Ack: seq=100, ack=0

[TCP] Initiating 3-way handshake...

BOTNET SPOOFER

Dormant

Spoofed SYN Generator 0 pkt/s

Src IP: 203.0.113.* (Never sends ACK)

Botnet idle — waiting for flood command

EDGE FIREWALL

L4 Scrubbing

IP Blocklist Rules PERMISSIVE

Ingress SYN Rate Normal (1/s)

[ACL] Allowing TCP :443 SYN packets

TARGET SERVER & BACKLOG

Healthy

Half-Open SYN Backlog 0 / 100 Slots

[Empty] No pending SYN_RECV entries

Established Sockets: 0 ACTIVE

Step 1 of 12

1. Client Sends SYN

A legitimate client sends a TCP SYN packet (seq=100) through the Edge Firewall to initiate a standard three-way handshake with the Target Server.

Component Inspector

Legitimate TCP Client

Click any card on the canvas to inspect its role in the TCP SYN flood and SYN cookie defense lifecycle.

What this component is doing now

Sending initial TCP SYN (seq=100) to open a connection.

Why this component matters

Represents real user traffic that must complete the 3-way handshake (SYN, SYN-ACK, ACK) even during DDoS attacks.

Interactive Runtime Config

READY · 2ms

How this component works with the rest of the system

Sends SYN through the Edge Firewall, receives SYN-ACK (or signed SYN cookie), and returns ACK to establish a socket.