All DDoS Definitions
DDoS Definition

FIN Flood

A FIN flood is a Layer 4 (transport) attack vector, one of the stateful floods a thorough DDoS test is built to exercise. It sends a high rate of TCP segments carrying the FIN flag, usually spoofed and referencing connections that were never established. A stateful firewall or load balancer must look up each segment against its connection table to decide whether it belongs to a live session, and that lookup, repeated millions of times per second, is the cost the attacker is buying. Unlike a SYN flood, which targets the accept queue, a FIN flood targets the connection-tracking table and the CPU that walks it.

FIN flood: out-of-state FINs, every lookup misses Spoofed sources high packets / second TCP flag: FIN set no prior handshake connection never existed FIN, FIN, FIN... Stateful firewall / load balancer Connection-tracking table FIN → look up 5-tuple FIN → look up 5-tuple FIN → look up 5-tuple FIN → look up 5-tuple every lookup: NO MATCH CPU 100% on lookups Real sessions starved of table capacity Contrast SYN flood hits the accept queue FIN flood hits the conntrack table and the CPU that walks it Test measures the packets / second at which the session table fills and whether out-of-state FINs are dropped early or carried deep into the stack. BlackNeuron™
FIN flood: spoofed TCP segments with the FIN flag set reference nonexistent connections, forcing a stateful firewall to burn CPU on connection-table lookups that all miss

Why it matters in DDoS testing

A FIN flood exposes whether middleboxes fail open or fail closed when their state tables saturate. A test measures the packets-per-second rate at which conntrack or the firewall session table fills, whether out-of-state FIN segments are dropped early or carried deep into the stack, and whether the device sheds legitimate sessions once it is full. These are properties of the stateful data path, which is why flag floods are tested alongside the other protocol-layer vectors rather than at the application tier.