SYN Flood is a DOS attack in which an attacker deliberately violates the three-way handshake
and opens a large number of half-open TCP connections. The signature of attack for SYN Flood
contains:
A.
The source and destination address having the same value
B.
A large number of SYN packets appearing on a network without the corresponding reply
packets
C.
The source and destination port numbers having the same value
D.
A large number of SYN packets appearing on a network with the corresponding reply packets
B is the Ans.
CEH.Module.09_Denial of service (slide 13)
Answer is A.
This is because the intention of this attack is to fill up connection table from the victim quickly. Victim does not have time to answer and it can be seen only a large number of syn packets.