A normal connection between a user (Alice) and a server. The three-way handshake is correctly performed. SYN Flood. The attacker (Mallory, green) sends several packets but does not send the "ACK" back to the server. The connections are hence half-opened and consuming server resources. Legitimate user Alice (purple) tries to connect, but the server refuses to open a connection, a denial of service.
![SYN flood - Wikipedia](https://cdn-ak-scissors.b.st-hatena.com/image/square/e40b07cee9015e0818e30e7b700392e1a6368d00/height=288;version=1;width=512/https%3A%2F%2Fupload.wikimedia.org%2Fwikipedia%2Fcommons%2Fthumb%2F9%2F9a%2FTcp_normal.svg%2F1200px-Tcp_normal.svg.png)