SYN flood: half-open connections and how a server resists

The idea

A SYN flood abuses the TCP handshake: the attacker sprays SYNs from forged source addresses and never sends the final ACK, so the server fills with half-open connections. This lab watches the pile grow and shows what really keeps the server alive — the kernel's SYN cookies — and where the attack is truly stopped.

Steps

1. A server answering normally

   Before the flood, see what healthy looks like: a real client completes the handshake and gets its page, and the server holds no half-open connections.

   legitClient:~# curl -s -o /dev/null -w 'legit=%{http_code}\n' --max-time 5 http://10.0.1.10/
   webServer:~# ss -tn state syn-recv

2. The flood

   The attacker opens the flood: sixty senders, each spraying SYNs at the server's port 80 from a different forged source (10.0.1.101–10.0.1.160) it does not own, and never sending the ACK. The server's half-open connections pile up on its port 80, their peers addresses the attacker never had.

   webServer:~# ss -tn state syn-recv