Which resource will be targeted by a TCP SYN flood attack?

When a host receives a SYN packet it allocates a Transmission Control Block (TCB) entry in its connection table and transitions to the SYN_RECEIVED state while awaiting the final ACK. A SYN flood fills this finite table with half-open connections that never complete, causing the host to refuse new legitimate TCP connections once the table is exhausted. This exhaustion of connection state - not bandwidth - is the defining characteristic of a SYN flood attack.

Transit routers do not maintain per-flow TCP connection state for traffic passing through them; SYN flood packets simply transit at line rate without consuming router send buffers.

SYN cookies are a defense mechanism against SYN floods that avoids allocating connection state until the handshake completes - they are a countermeasure, not a resource depleted by the attack.

Routers closest to the target forward packets at line rate without storing TCP connection state in shared memory; stateful connection tracking resides on the end host, not on transit routers.