Explain TCP 3-Way Handshake, SYN Flood Attacks, and how network firewalls mitigate them.

The Transmission Control Protocol (TCP) is a connection-oriented, reliable transport protocol that establishes communication sessions using the 3-Way Handshake:

1. Step 1 (SYN): The client sends a packet with the SYN (Synchronize) control flag set and an initial sequence number (ISN_c) to request a connection.
2. Step 2 (SYN-ACK): The server responds with SYN-ACK, acknowledging the client's sequence number (ACK = ISN_c + 1) and providing its own sequence number (ISN_s). The server allocates memory in its backlog queue (half-open connection state).
3. Step 3 (ACK): The client replies with an ACK (ACK = ISN_s + 1). The connection is established and data transfer begins.

The SYN Flood Denial of Service Attack:

In a SYN Flood Attack, an attacker sends an overwhelming flood of TCP SYN packets, often spoofing non-existent source IP addresses, and deliberately withholds the final ACK packet. The target server's half-open connection backlog queue rapidly exhausts its memory limits, causing it to reject legitimate incoming connections.

Firewall & Operating System Mitigations:

• SYN Cookies: The server does not allocate memory when receiving a SYN packet. Instead, it encodes the connection state mathematically into the initial sequence number (ISN_s). Only when the client sends the valid final ACK does the server reconstruct the connection in memory.
• TCP SYN Proxy: Next-Generation Firewalls (NGFW) terminate the 3-way handshake on behalf of the protected server. Only after the client completes the third ACK does the firewall open a genuine connection to the backend server.
• Rate Limiting & Threat Intelligence: Dropping excessive SYN requests exceeding per-second IP thresholds.