Unlike a SYN flood, a PSH-ACK flood does not ask for a new connection; it pretends to be the middle of one that already exists. It is a Layer 4 attack vector, one of the stateful floods a thorough DDoS test is built to exercise: a high rate of TCP segments with the PSH and ACK flags set, usually carrying a payload, from sources that never completed a handshake. The flag pair is chosen because it is what ordinary data traffic looks like, and on some firewalls that disguise is enough to get each packet a row in the connection table.
How a PSH-ACK flood works
The parent class is the protocol attack: small packets, stateful targets, damage done by rate. The common description says the PSH flag forces the receiver to process each packet at once. That is not where the cost comes from. PSH only tells a receiver with a live connection to hand buffered data to the application; on a segment that matches no connection it means nothing. The flags matter for a different reason: PSH-ACK is the most ordinary-looking segment on the wire, so a filter cannot drop it by flag without dropping real traffic too.
What it costs depends on the device.
On a firewall with strict tracking, it is the familiar lookup and miss. On a Linux-based firewall or Kubernetes node with the default nf_conntrack_tcp_loose=1, it can be worse. That setting lets connection tracking adopt a connection it never saw open, from any segment that carries ACK, so the spoofed segment is classified as the first packet of a mid-stream flow rather than as invalid. If the ruleset then accepts new flows to that port, which it will for any public service, the entry is kept, and while nothing answers it, it can linger for minutes rather than milliseconds because no reply ever acknowledges its data. The flood stops costing lookups and starts costing rows.
Why it matters under attack
That adoption is why this vector can fill the connection-tracking table when a FIN or RST flood at the same rate cannot. It is also why an old iptables idiom still appears in hardened rulesets: drop any TCP segment that is in state NEW but does not carry SYN. That one rule stops the adoption before a row is written. Turning loose pickup off does the same, at the price of breaking flows that survive a firewall failover, which is the reason it was left on by default.
The payload adds a second axis. Many PSH-ACK floods pad each segment towards a full-size packet, so the same stream is heavy in bits as well as in packets, and an inline IPS that inspects payloads spends effort on content before it ever learns the segment belongs to nothing. A defender watching one metric sees half of the attack.
The origin answers, too. A segment carrying ACK that arrives for no connection draws a RST from a standards-following stack, whether the port is closed or listening. Any of the flood that slips past the stateful tier therefore doubles at the host, inbound segments in and resets out, aimed at the forged sources.
What a DDoS test measures
A test checks first whether spoofed PSH-ACK segments create entries. It sends them at a low rate and watches the table count on each Linux-based device in the path. If the count climbs, the vector is a table-exhaustion case, and the measurement becomes how long until nf_conntrack_max is reached at the attack rate. If it stays flat, the measurement is lookup CPU, as with the other flag floods.
It then verifies the controls in order: is the NEW-without-SYN drop present on every node that tracks state, not only the main firewall; does an upstream stateless stage discard out-of-state segments; does the IPS inspect before or after the state check; and are the origin's outbound resets visible on the dashboards anyone watches. How this vector is exercised alongside the volumetric floods it usually rides with is described in Multi-Vector DDoS Testing.