Every client-server conversation begins with a standardized three-way handshake. The client sends a SYN packet, the server responds with a SYN-ACK, and the TCP connection is established. In a SYN flood attack, the client sends massive numbers of SYN requests, and never responds to the SYN-ACK messages from the server.