The hold line (the listen queue, and the SYN flood)

The TCP handshake in real bytes: SYN, SYN+ACK, ACK, each with its random starting number. This lesson is about the server’s side of that drawing: what it writes down after the second message, and what happens when millions of callers never send the third.

Before you start. From TCP vs UDP, and the 3-way handshake you have the phone call: TCP opens with three messages (“can you hear me?”, “yes, and can you hear me?”, “yes”), each side says a random starting number, and the return address on a packet is whatever the sender wrote, so it can be forged. From The page that never arrived (TCP reliable delivery) you have the server’s half in code: a program claims a port and waits (LISTEN), and accept() hands it each finished call as a new socket. This lesson is what happens between those two, when calls come in faster than the program picks them up.