SYNRECV

SYNRECV is a TCP connection state used by the Linux kernel’s connection tracking subsystem to represent a partially established connection. Specifically, a connection enters the SYNRECV state after the server has received a SYN from a client and has sent a SYN-ACK in response but has not yet received the final ACK to complete the three-way handshake.

Origin and purpose

When a new TCP connection is initiated, the kernel creates a conntrack entry to monitor the handshake. During the window between sending the SYN-ACK and receiving the client’s ACK, the entry is in SYNRECV. This state helps the system distinguish half-open connections from fully established ones and supports security and performance features such as SYN flood protection and selective resource allocation.

Transition and lifecycle

If the client completes the handshake by sending the ACK, the conntrack state transitions to ESTABLISHED. If the handshake times out or is otherwise aborted, the entry is typically removed or marked INVALID. The SYNRECV state is therefore transient and reflects a specific phase of the TCP handshake rather than an ongoing connection.

Usage in firewalls and networking tools

Administrative and security tools can match on the SYNRECV state to apply rules to half-open connections, implement rate limiting, or trigger protections against SYN floods. In Linux environments, commands and tools that inspect connection tracking (such as conntrack or nftables/iptables) may display or filter by SYNRECV.

Relation to related concepts

SYNRECV is one of several conntrack states used to describe TCP connection life cycles, alongside NEW, ESTABLISHED, RELATED, and INVALID. It is distinct from the normal fully established state and is mainly relevant during the initial handshake phase.