Which router feature protects TCP servers from a TCP SYN-flooding attack?

• A. HOIC
• B. LOIC
• C. Wavelet-Based Signal Analysis
• D. TCP Intercept

Answer: (D)

A key defense concept here is reducing how many half-open TCP connections a server has to handle during a flood. A router feature that does this works as a TCP proxy in front of the protected server. It intercepts incoming SYNs, completes the handshake with the client itself, and then forwards a controlled connection to the real server (or handles the handshake on behalf of the server). By doing so, it absorbs the burden of the flood and enforces connection limits, preventing the server from becoming overwhelmed. This mechanism is known as TCP Intercept.

The other options are not about protecting a server from a SYN flood: HOIC and LOIC are attack tools used to generate traffic, not defenses, and Wavelet-Based Signal Analysis is a technique for analyzing signals, not a router feature for mitigating SYN floods.