This disperses the total load of the attack and reduces the peak load on each individual system. The idea is for the incoming DDoS data stream to be distributed across many individual systems. Therefore, the services of large, globally-distributed cloud providers are increasingly being used.

The resulting DDoS attacks, with their enormous flood of data, can bring even the strongest systems to their knees. However, modern attackers have far more firepower at their disposal thanks to botnets. The fight against DoS attacks is as old as the Internet itself. The positive aspects of both techniques are thus combined. If the SYN cache is full, the system switches to SYN cookies. The SYN cache is used in normal operation. However, under certain circumstances, it can lead to performance losses.ДЄ combination of both techniques can also be used. The use of SYN cookies offers effective protection against SYN flood attacks.

The server uses the sequence number of the ACK packet to cryptographically verify the connection establishment and to establish the connection. Cryptographic hashing ensures that the attacker cannot simply guess the sequence number.ДЄ legitimate client replies to the SYN/ACK packet with an ACK packet and uses the specially prepared sequence number. Instead, the relevant connection parameters are encoded in the sequence number of the SYN/ACK packet. The Transmission Control Block is not used as a data structure in this case. The concept of the SYN cache continued with the invention of SYN cookies in 1996. Connection data can only be lost in a few special cases. The SYN cache has proven to be an effective technique. The technique uses cryptographic hashing to prevent the attacker from guessing critical information about the connection. The idea behind the SYN cache is simple: Instead of storing a complete Transmission Control Block (TCB) in the SYN backlog for each half-open connection, only a minimal TCB is kept.

Success syn