A FIN flood is usually described as a connection-table attack: a high rate of TCP segments carrying the FIN flag, spoofed and referencing connections that were never opened, each one forcing a stateful device to look it up and miss. That is true only on paths where a tracking device actually inspects the FINs, and finding out whether yours is one of them is part of what a DDoS test is for. On plenty of real paths the first filter never inspects the flag at all, and the segments arrive at the origin, which answers them.
How a FIN flood works
As a protocol attack it is measured in packets per second, and at a stateful device the cost is the familiar one: a lookup, a miss, a drop. The FIN-specific part is what happens at the two places where that lookup does not occur.
The first is the stateless filter in front. A FIN is the flag that closes a connection, so a rule written to stop inbound connections by dropping SYN segments has nothing to say about it. That gap is old enough to have a name. The FIN scan (nmap -sF) exists because FIN segments pass filters that only watch for SYNs, and a FIN flood travels the same route. Most floods in practice set FIN and ACK together, and that variant also satisfies the classic router established match, which accepts any segment with ACK or RST set. An access control list that looks healthy can wave the whole flood through.
The second is the origin itself. RFC 793 says a closed port refuses any segment that is not itself a reset, so a FIN aimed at a port nobody is listening on comes back as a RST. So every FIN that reaches a closed port produces an outbound packet aimed at the forged source, and the host's uplink carries a second flood in the other direction. A bare FIN to a listening port is dropped silently by a standards-following stack, which is precisely the open-versus-closed difference the FIN scan reads, though Windows and some network appliances answer RST either way.
Why it matters under attack
Where the flood is finally caught decides which failure you get. Caught statelessly upstream, it costs almost nothing. Caught at a stateful firewall, it costs lookup CPU. Not caught at all, it costs the origin both the inbound packets and an equal stream of outbound resets.
That reflexive traffic has a second audience. Resets sent to spoofed addresses scatter across the internet as backscatter, and research telescopes have used exactly that signal since Moore, Voelker and Savage's 2001 study to count denial-of-service attacks nobody reported. For the defender it means a FIN flood against one service can show up as unexplained outbound load at the edge, which is easy to misread as the origin attacking someone else.
On a Linux-based firewall the detail that matters is classification. Connection tracking marks a FIN that matches no entry as invalid, and it does not create a row for it, so unlike some flag floods this one cannot fill the connection-tracking table directly. Whether the ruleset drops invalid-state packets at the top of the chain, or lets them walk every rule first, is a configuration choice that can move the device's breaking point by a wide margin.
What a DDoS test measures
The first job is locating where the flood actually stops. A test sends FIN and FIN-ACK segments at a modest rate and records where they stop: at a stateless rule, at the stateful tier, or at the origin. A path can answer "the origin" for the FIN-ACK form only, so both forms are worth sending.
Then it measures the rate each stage absorbs before CPU saturates or real sessions stall, and on the origin it watches outbound resets alongside inbound load, since a host answering a flood is spending uplink on it. The fixes it checks are concrete: a stateless rule that drops out-of-state FIN segments ahead of tracking, an early invalid-state drop on the stateful tier, and closed ports filtered at the edge rather than left for the origin to refuse. Deciding which tier gets the drop rule is a resilience question as much as a filtering one, and DDoS Resilience Testing shows how to read the per-stage results that answer it.