Exam 312-49v10 topic 1 question 679 discussion

The malicious entity sends a barrage of SYN requests to a target server but intentionally avoids sending the final ACK. This leaves the server waiting for a response that never comes, consuming resources for each of these half-open connections.

SYN flooding is a type of Denial-of-Service (DoS) attack in which the attacker sends large number of SYN packets repeatedly to the target server using multiple spoofed IP addresses that never return an ACK packet, thus keeping the server busy and rendering it unresponsive

https://kb.mazebolt.com/knowledgebase/rst-syn-flood/

C. Wireshark capture shows multiple SYN requests and RST responses from single/multiple IP address(es) In a SYN flood attack, the attacker sends a large number of SYN (synchronization) requests to a target server, often with spoofed IP addresses, in an attempt to overwhelm the server's resources and cause it to become unresponsive. When analyzing traffic using Wireshark, you might notice multiple SYN requests followed by RST (reset) responses. This is because the target server sends RST responses to the incoming SYN requests to indicate that it is not able to establish a full connection due to the flood of incoming SYN requests. This behavior is a characteristic sign of a SYN flood attack.