Which term describes a DoS attack that relies on an incomplete TCP handshake?

• A. half-open
• B. half-close
• C. Both A and B
• D. Neither A nor B

Answer: (A)

A DoS attack that relies on an incomplete TCP handshake exploits the way TCP establishes connections. In a normal three-way handshake, the client sends a SYN, the server replies with a SYN-ACK, and the client responds with an ACK to complete the connection. If an attacker floods the server with SYN packets but never completes the handshake with the final ACK, the server must allocate resources and keep track of those half-open connections in its backlog. Since the handshake isn’t completed, these connections remain in a half-open state, tying up resources and potentially exhausting the server’s capacity to accept new legitimate connections. That’s why this attack is described as half-open.

Half-close, by contrast, refers to one side ending an established connection in a way that still leaves the other side with an open state, which is a normal part of connection termination and not a DoS technique. So the best term for this scenario is half-open. Mitigations include SYN cookies, backlog tuning, and rate limiting to prevent backlog exhaustion.