SYN Flood Attack Detection: Incomplete TCP Handshake
An analyst captures network traffic and sees a large number of packets with source IP 10.0.0.1, destination IP 192.168.1.1, TCP SYN flag set, with sequence numbers that appear incremental. The destination responds with SYN-ACK but the source never completes the handshake. Which attack is MOST likely occurring?
Quick Answer
The answer is a SYN flood attack. This is correct because the attacker sends a barrage of TCP SYN packets—often with spoofed or non-responsive source IPs like 10.0.0.1—and then never completes the three-way handshake by sending the final ACK, leaving the server with half-open connections that consume memory and exhaust resources. On the Certified Ethical Hacker CEH exam, this scenario tests your ability to recognize the signature of an incomplete TCP handshake in a packet capture, a classic denial-of-service technique. A common trap is confusing this with a SYN scan, but a scan typically uses a single source IP and does not aim to overwhelm resources; here, the incremental sequence numbers and repeated SYN-ACK responses without completion are the giveaway. Memory tip: think “SYN sent, ACK absent—server’s patience spent.”
⚠ Common exam trap
Many candidates confuse a SYN flood with a TCP three-way handshake completion failure due to a firewall or routing issue, but the key indicator is the large number of SYN packets with no final ACK, which is the hallmark of a deliberate DoS attack, not a network glitch.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SYN flood
This behavior describes a classic SYN flood attack. The source (10.0.0.1) sends a high volume of TCP SYN packets with incremental sequence numbers to the target (192.168.1.1). The target responds with SYN-ACK packets, but the source never sends the final ACK to complete the three-way handshake. This leaves the target with half-open connections that exhaust its connection table, denying service to legitimate traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ARP poisoning
Why it's wrong here
ARP poisoning manipulates MAC-to-IP mappings on the local segment; it does not generate SYN packets with incremental sequence numbers from a spoofed source. It would be the answer for traffic redirected through a forged gateway MAC, not for half-open TCP connections.
- ✓
SYN flood
Why this is correct
The flood of SYN packets with spoofed or unused source addresses, followed by incomplete handshakes, exhausts the target's half-open connection table. The destination's SYN-ACKs go unanswered because no real client exists, which is the defining signature of a SYN flood.
- ✗
ICMP flood
Why it's wrong here
An ICMP flood sends echo-request packets that elicit echo replies; it involves no TCP flags or sequence numbers. It is tempting as another volumetric spoofed-source denial-of-service attack, but the observed SYN/SYN-ACK pattern is TCP-specific, which ICMP cannot produce.
- ✗
DNS amplification
Why it's wrong here
DNS amplification floods a victim with oversized UDP responses to spoofed queries, not TCP SYN packets that receive SYN-ACKs. It is tempting because it also spoofs source addresses, but it operates over UDP port 53 and never involves a half-open TCP handshake.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst runs the command 'tcpdump -i eth0 -n host 10.0.0.5 and port 80' and sees many packets with the SYN flag set but no corresponding ACK. Which attack is likely occurring?
medium- ✓ A.SYN flood
- B.ICMP flood
- C.UDP flood
- D.Ping of Death
Why A: The command captures TCP packets on port 80 with the SYN flag set but no corresponding ACK, which indicates that the target is receiving SYN requests but never completing the three-way handshake. This is the hallmark of a SYN flood attack, where the attacker sends a high volume of SYN packets to exhaust the server's connection queue, preventing legitimate connections.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.