What is a SYN attack?
Definition
SYN attack (also called a SYN flood) is a denial-of-service attack that sends a server a flood of connection requests it never completes, leaving half-open connections that block real visitors.
- Category
- Attacks
- Also called
- SYN flood, SYN flooding, TCP SYN flood
- Last updated
A SYN attack abuses the way internet connections start. When your browser contacts a website, it sends a SYN packet (a request to open a connection). The server answers with a SYN-ACK and waits for your device to confirm. That three-step exchange is the TCP handshake.
In a SYN flood, the attacker sends SYN packets to an open port and never sends the final confirmation. CISA's DDoS guide describes this as establishing half-open connections to a node: the target replies with a SYN-ACK and tries to establish a connection that never finishes. Each half-open connection takes up space until it times out.
Operating systems only allow so many TCP connections at once. CISA describes the result as state exhaustion: once the limit is hit, the server can't accept new connection requests, and legitimate users lose access to the service.
A concrete example
A small online shop runs on one web server. Someone aims a SYN flood at it during a sale. Nothing is stolen and no one gets into the server. Customers simply see the site hang or time out until the attack stops or the host filters the traffic.
SYN attack vs. related terms
- DoS and DDoS attacks are the broader family. A SYN flood is one technique inside it. A DDoS uses many machines at once, which is what makes it hard to block.
- A data breach takes data. A SYN attack takes availability: it makes a service unreachable but doesn't expose anything on its own.
Why it matters to you
You're unlikely to be the direct target. The effect lands on you when a service you rely on, such as a bank, a game or a store, goes down. For site owners the fix sits with the hosting provider or a network-level filtering service, not with the individual visitor.
How to protect yourself
- 1
Check whether it's the service or your connection
If one site won't load but others do, the problem is probably on their side. Wait and retry rather than reinstalling anything or entering your details on a page that suddenly asks for them.
- 2
Beware of fake outage notices
Outages are a good cover for scam emails and texts that say your account is locked. Open the company's site or app yourself instead of following a link.
- 3
If you run a site, talk to your host
Ask your hosting provider what DDoS protection is included. CISA's DDoS Quick Guide is a good primer to read first.
- 4
Keep your own devices clean
Attackers often use infected devices to send floods. Install updates and change default passwords on routers and cameras so yours isn't one of them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
Is a SYN attack the same as a DDoS attack?
Not exactly. A SYN flood is a technique. It can come from one machine or from many. When many machines send it together, it's a distributed denial-of-service (DDoS) attack.
Can a SYN attack steal my data?
On its own, no. It aims to make a service unavailable, not to read what's stored on it.
Can my home computer be hit by a SYN attack?
It's possible if you expose a port to the internet, but it's rare. Most home devices sit behind a router that drops unsolicited connection requests.
Sources
Something wrong or out of date? Tell us and we'll re-check it.