Which type of attack is a protocol attack?

An HTTP flood is typically an application-layer (Layer 7) denial-of-service attack that overloads a web server with legitimate or malformed HTTP requests, rather than directly exploiting a fundamental protocol mechanism.

A TFTP flood is an application-layer attack that overwhelms a TFTP server with excessive requests, consuming its resources, but it does not exploit a specific protocol vulnerability in the way a SYN flood does for TCP.

A SYN flood is a classic protocol attack that exploits the TCP three-way handshake by sending a high volume of SYN requests without completing the ACK, overwhelming the server's connection table and consuming resources. This directly attacks the state machine of the TCP protocol.

Slowloris is an application-layer DoS attack that keeps HTTP connections open by sending partial requests, consuming server resources slowly. While it uses the HTTP protocol, it primarily exploits server resource handling rather than a protocol state machine flaw.