A SYN-ACK flood is a Layer 4 (transport) attack vector, one of the attack classes a thorough DDoS test is built to exercise. It sends a high volume of TCP SYN-ACK packets at the target, none of which belong to a connection the target ever initiated. A SYN-ACK is normally the second step of the handshake, so a stateful firewall, load balancer, or server has to check each one against its connection table, find no matching outbound SYN, and drop it. That table lookup is the cost: at millions of packets per second the device spends its CPU rejecting packets instead of serving traffic. SYN-ACK floods also show up as a reflection payload, since a spoofed SYN sent to a third-party server makes it fire an unsolicited SYN-ACK straight at the victim.
Why it matters in DDoS testing
A SYN-ACK flood targets the connection-tracking state of inline devices, not raw bandwidth, so a stack sized only for volumetric floods can still fall over. A DDoS test measures how many spurious SYN-ACKs per second the firewall and its conntrack table absorb before legitimate handshakes start failing, and whether stateless filtering or a SYN-ACK rate control holds under load. For where this sits among the network-layer classes, see Understanding DDoS Attack Vectors.