What phase of the TCP communication process is attacked during a TCP SYN flood attack?

During the TCP three-way handshake, a server responds to each SYN with a SYN-ACK and allocates connection state while waiting for the final ACK. In a SYN flood, the attacker sends a high volume of SYN packets with spoofed source IPs and never sends the final ACK, filling the server's backlog queue with half-open connections until it is unable to accept any legitimate new connections.

The connection established phase occurs only after the three-way handshake completes successfully - SYN flood attacks prevent connections from ever reaching this state by exhausting the handshake backlog.

The connection closed phase involves FIN or RST packets to terminate an already fully established session, which is a separate mechanism unrelated to SYN flood attacks.

A connection reset uses RST packets to abruptly terminate an already-established TCP session, which is a different process from the SYN flood's exploitation of incomplete half-open connections.