Which attack targets the TCP state table by sending a flood of SYN packets with spoofed addresses to deplete resources?

• A. ACK and PUSH ACK Flood Attack
• B. SYN Flood Attack
• C. Fragmentation Attack
• D. HTTP GET Attack

Answer: (B)

When a server handles TCP connections, it keeps track of each partially established connection after receiving a SYN and before the final ACK completes the three-way handshake. Flooding the target with SYN packets that use spoofed source addresses forces the server to allocate resources for each of those half-open connections, even though no real client will complete the handshake. Because the final ACK never arrives, those entries stay in the TCP state table, gradually exhausting it and preventing legitimate clients from establishing new connections. This is the classic SYN flood: it targets the TCP state tracking mechanism itself.

The other options don’t fit as well. An ACK flood would overwhelm the receiver with ACKs, but it doesn’t specifically exploit the handshake process or fill the TCP state table in the same way. A fragmentation attack focuses on IP fragmentation behavior rather than TCP connection state. An HTTP GET attack targets the application layer by flooding with requests, not the TCP handshake resources.