SYN flood
A denial of service attack that sends TCP SYNs, often from spoofed sources, to exhaust a server's half-open connection state.
A SYN flood abuses the TCP handshake. Each SYN makes the server allocate state and reply with SYN-ACK, then wait for an ACK that never comes. With spoofed source addresses the attacker spends almost nothing while the server's backlog fills and legitimate connections are dropped (RFC 4987 describes the attack and defences).
The classic defence is SYN cookies: the server encodes connection parameters into the SYN-ACK sequence number and allocates state only when a valid ACK returns. At scale, edges add per-source rate limits, SYN proxies and XDP/eBPF filters that drop junk before the kernel network stack.
In interviews, contrast it with volumetric floods (bandwidth exhaustion, solved by capacity and anycast) and layer 7 floods (valid requests, solved by WAF and bot controls).