What gets used up
A server has limited resources: memory, processor time and the bandwidth of its link. Each visitor uses a little. Here a client opens a TCP connection with SYN, SYN-ACK and ACK, and is served.
Between its SYN-ACK and the client's ACK, the server keeps a small record in a queue called the backlog. The connection is half-open, in the SYN-RECEIVED state. The backlog has a fixed size: 4 slots here.
SYN flood
An attacker sends SYN after SYN, each with a forged (spoofed) source address. IP does not check who really sent a packet, so each SYN looks like a new visitor. Every one takes a backlog slot.
The server sends each SYN-ACK to the forged address. Nobody there asked, so no ACK comes back. Each record waits until the server gives up after a few retries, and the attacker keeps sending new SYNs faster than that.
Now the real client sends its SYN. The backlog is full of fake half-open records, so the server drops it, and the client only sees a timeout. The attacker needed only small SYN packets, not a big link.
Distributed and amplified
Traffic from one computer is easy to block. So attackers use a botnet: thousands of hacked devices, often cameras and home routers with default passwords, controlled remotely. When they attack together, it is a distributed denial of service, or DDoS.
A volumetric attack skips the tricks and sends sheer volume. Here 10,000 bots send 1 Mbit/s each: 10 Gbit/s at a 1 Gbit/s link. The link overflows before the server, and real packets are dropped with the junk.
Instead of hitting the victim directly, a bot sends a small DNS question to an open resolver, a server that answers anyone. It forges the source address as the victim's. DNS uses UDP, with no handshake, so the resolver cannot tell.
The resolver sends its answer to the victim. The answer is much bigger than the question: here 60 bytes in, 3,000 out, 50 times larger. Thousands of reflectors multiply the attack, and the victim drowns in replies it never asked for.
Defences
SYN cookies let a server answer a SYN without keeping a record. Networks drop packets with forged sources (BCP 38). Rate limits and scrubbing services absorb floods, and resolvers stop answering strangers. The next lesson shows each defence working.
The packets, step by step
;; step 1/10 · normal-visit ;; client → server TCP 192.0.2.7:51514 → 203.0.113.10:443 SYN TCP 203.0.113.10:443 → 192.0.2.7:51514 SYN-ACK TCP 192.0.2.7:51514 → 203.0.113.10:443 ACK state ESTABLISHED: the server now serves the page cost a little memory, processor time and link bandwidth per visitor
Illustrative numbers: a 4-slot backlog (real servers hold hundreds or more), 10,000 bots at 1 Mbit/s against a 1 Gbit/s link, and a 60-byte DNS query drawing a 3,000-byte answer (50×, inside the 28 to 54× that US-CERT alert TA14-017A measured for DNS). This lesson shows how the attacks work, not how to run them. The defence lesson that follows shows SYN cookies (RFC 4987), ingress filtering (BCP 38, RFC 2827), rate limiting and scrubbing working against them.