Three-way Handshake as a Security Threat

The TCP three-way handshake is fundamental for establishing a reliable connection between two hosts. It involves a client sending a SYN (synchronize) packet, the server responding with a SYN-ACK (synchronize-acknowledge) packet, and the client completing with an ACK (acknowledge) packet. While designed for connection setup, its process can be exploited as a security threat, primarily through a SYN flood attack.

In a SYN flood, an attacker sends numerous SYN requests to a target server but does not complete the handshake by sending the final ACK packet. When the server receives a SYN request, it allocates resources, such as memory for connection tables, and sends a SYN-ACK response, then waits for the client's ACK. By not responding, the attacker leaves these connections in a 'half-open' state.

If the attacker sends a large volume of SYN requests, the server's connection queue and resources quickly become exhausted. This prevents legitimate clients from establishing new connections to the server, resulting in a Denial of Service (DoS). The server becomes unresponsive to valid traffic as it is overwhelmed by the backlog of half-open connections.

This type of attack is detailed in texts on computer network security, such as "Guide to Computer Network Security" by Joseph Migga Kizza, which discusses various forms of DoS attacks and their underlying mechanisms in TCP/IP connections. https://books.google.com.gh/books?id=sbA_AAAAQBAJ