TechKnowSurge

VideoSecurityFree

DEMO: TCP SYN Flood Attack

A TCP SYN flood attack exploits the TCP three-way handshake by overwhelming a server with connection requests, exhausting its resources and blocking legitimate users. This content covers how the attack works and demonstrates it using Kali Linux in a controlled lab environment.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

TCP is a foundational transport-layer protocol responsible for establishing reliable connections across networks, and it does so through a three-way handshake consisting of SYN, SYN-ACK, and ACK exchanges between a client and server. Every standard connection, including a basic web page request, requires this handshake before any data is transferred. A TCP SYN flood attack exploits this mechanism by sending a continuous stream of SYN requests to a target server without ever completing the handshake, forcing the server to hold open and track a growing number of half-open connections until its resources are exhausted and it can no longer serve legitimate users. This content demonstrates the attack in a controlled lab environment using Kali Linux, showing how to direct a flood of SYN packets at a specific destination port, in this case port 80, and how randomized source addresses are used to prevent reply traffic from returning to the attacking machine. The demonstration confirms the real-world impact of the attack, taking a live web server offline within moments and restoring it immediately upon stopping the flood. The material is intended strictly for ethical use within authorized networks, framing the technique as a practical tool for understanding denial-of-service vulnerabilities and testing network resilience.

What you'll learn

Explain how a TCP SYN flood attack exploits the three-way handshake process to exhaust server resources and cause denial of service
Identify the key characteristics of a TCP SYN flood attack, including SYN flag manipulation, randomized source addresses, and targeted destination ports

What's covered

TCP SYN Flood Attack

TCP Fundamentals
- Layer 4 Transport Protocol
- Part of TCP/IP Stack
- Used for Network Communication
Three-Way Handshake
- SYN: Client Requests Connection
- SYN-ACK: Server Responds
- ACK: Connection Established
- Connection Tracked by Server
How SYN Flood Works
- Floods Server with SYN Requests
- Server Overwhelmed Tracking Connections
- Legitimate Users Denied Access
Attack Demonstration
- Kali Linux Used
- SYN Flag Set in Command
- Destination Port 80 Specified
- Randomized Source Addresses

Key terms

Transmission Control Protocol: A connection-oriented transport protocol that ensures reliable, ordered, and error-checked delivery of data.
Denial of Service: An attack that floods a system or network with traffic to make it unavailable to legitimate users.
Spoofing: An attack where an adversary impersonates a trusted entity by falsifying data such as an IP address or email address.
Port: A logical endpoint for communication in a network, identified by a number that specifies a particular service or application.
Three-Way Handshake: The TCP connection establishment process consisting of SYN, SYN-ACK, and ACK exchanges between a client and server.
SYN Flood: A denial of service attack that overwhelms a server by sending a high volume of TCP SYN requests with randomized source addresses, exhausting server resources without completing the handshake.

Topics

Network Security Tcp Ip Denial Of Service Syn Flood Kali Linux Ethical Hacking

Transcript

How TCP sets up a connection

TCP is a critical protocol that we use for a ton of the communication we do across the internet, or really across any of our networks. It is part of layer 4, a transport protocol, and it is a big part of the TCP/IP stack, which is the primary stack we use for communication using our computers.

Let us say our machine was connecting to a web page. Before that web page could even be requested, TCP needs to do its thing. It needs to make a connection, and it does that by doing a three-way handshake. This client machine says, "Hey, can we communicate?" And the server replies back and says, "Yeah, let's communicate." Great, we are communicating now. So this is the three-way handshake that happens, with a SYN, a SYN-ACK, and an ACK.

This is what that TCP header looks like. I do not want to get real in depth into this, but just know that when we are establishing that connection, the first thing it does is say, "Hey, let's communicate," by putting a one in that SYN flag right there. The rest of these would be zero. Then the reply back is yes, let us communicate, and the SYN-ACK means that both of those flags are turned on. Then the client machine sends a one in the acknowledgement back, saying great, we are communicating now.

What this three-way handshake does is open up a connection that remains open between the client and the server until one of those closes the connection, or the connection times out. So this server is keeping track of that connection.

What a SYN flood does

What we are doing with a TCP SYN flood is that we are sending a bunch of these "hey, can we make a connection here" SYN messages. We are turning that flag on and trying to establish and make a ton of connections with the server. We can make more than one connection; this server will allow it. So it is going to be opening and tracking all those connections and responding back with this SYN acknowledgement, SYN-ACK, back.

Carrying out the attack

It is actually very simple to carry out this type of attack, but make sure you are practicing ethical hacking only. This is really meant just for you to test within your own network, or a network that you have got permission to use and carry out this type of attack on.

I am on a demo laptop right here, and as you can see I have got this 10.130.23 website up. I can hit refresh and you can see that it refreshes, so it is all fresh, and we also have this ping going through. So what we are going to do is attack this website and see if we can bring it down.

I am on my Kali Linux here, and what I am going to do is hit the up key, because in a prior lesson I talked about doing an amp flood attack, and we can see now that this says ICMP. All we have to do for opening up these SYN connections, these TCP connections, is type in SYN. That is going to be the big change with this. Essentially what this is doing is setting that flag, turning that flag on, saying, "Hey, we want to talk to you."

The other thing that we are going to do is specify the destination port. In order to specify the destination port, what we are going to type in with this is dash dst port, space, 80. So we have got that typed in there, and then we are going to hit enter and see what happens.

As we can see, it did it. It is no longer pingable here, so it is using those resources. I hit refresh on the computer here, on the web browser here, and that is not coming up either. So what we have in fact done is we are still making those requests, "hey, can we open up a connection with you," and that has caused this problem.

Now let us bring up our Kali box again and hit control C to end that. Notice now our ping comes up and we are now connected to this website; it has been brought back up as well.

We did have part of this command, the flood, which allows us to send multiple requests at any given time, and the random source, so that we are choosing an address, we are sending a source address that is randomized, so that these requests are not coming back to this machine.

So here is our attack card on the TCP SYN flood. Essentially we are just overwhelming this server with enough SYN requests so that regular users are no longer able to access those resources.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →