SynReceived

SYNRECEIVED is a TCP connection state used in some operating systems’ TCP state machines. It occurs after a server socket has received a SYN from a client and has replied with a SYN-ACK, and it is waiting for the final ACK from the client to complete the three-way handshake.

In this state, the system typically tracks the half-open connection and may allocate resources or a slot in the listen backlog to monitor the in-progress handshake. The server may also retransmit the SYN-ACK a limited number of times while waiting. If the client sends the final ACK, the connection progresses to ESTABLISHED. If the ACK is not received within the retransmission timeout, the connection is usually closed and resources are released.

SYNRECEIVED is distinct from LISTEN, where a server is waiting for an initial SYN, and from ESTABLISHED, where the connection is fully open. The exact terminology and representation of this state can vary between implementations (commonly referred to as SYN_RECV, SYN_RECEIVED, or TCP_SYN_RECV).

This state is a normal part of the TCP handshake but can become problematic under high load or during a SYN flood attack, when many half-open connections consume backlog resources. Modern stacks mitigate such risks with mechanisms like SYN cookies, backlog tuning, or rate-limiting to prevent resource exhaustion.

See also: TCP three-way handshake, LISTEN, ESTABLISHED, SYN_SENT, backlog, SYN flood, SYN cookies.