What is a SYN cookie and how does it help mitigate SYN flood attacks?

• A. A SYN cookie encodes connection state into the initial sequence number to avoid reserving resources until the handshake completes.
• B. A method to increase maximum window size.
• C. A protocol used for data encryption.
• D. A method to prioritize TLS handshake.

Answer: (A)

SYN cookies prevent the server from allocating resources for half-open connections until the handshake can be completed. When a SYN arrives, instead of reserving memory to track that half-open state, the server sends back a SYN-ACK with an initial sequence number that encodes a cookie—typically a hash or secret-based value that represents the connection parameters. The server does not store per-connection state at this point.

If the client and its final ACK come back, the server can verify the ACK against the cookie, reconstruct the necessary connection state, and then allocate real resources to establish the connection. In a SYN flood, many bogus SYNs would otherwise consume memory; with SYN cookies, the server can respond to many attempts without exhausting its resources, allowing legitimate clients to connect once their handshake completes.

Other options don’t fit because they address throughput, encryption, or TLS prioritization rather than mitigating resource exhaustion from half-open TCP handshakes.