A cybersecurity analyst is hired to review the security the posture of a company. The cybersecurity analyst notice a very high network bandwidth consumption due to SYN floods from a small number of…

Increasing bandwidth does not stop the attack - it only delays resource exhaustion and provides no security value against the underlying flood.

Ingress filtering at routers allows the security team to drop packets sourced from the identified attacking IP addresses at the network edge, stopping the SYN flood before it saturates internal systems. This is a targeted response that preserves legitimate TCP connections while neutralizing the threat source. RFC 2827 formalizes ingress filtering as the recommended control for blocking spoofed or known-malicious source addresses at the perimeter.

A packet capture tool is useful for forensic analysis and evidence collection but does not actively reduce or stop the incoming SYN flood traffic.

Blocking all SYN packets would prevent every new legitimate TCP connection from being established, causing a complete self-inflicted denial of service for all users and services.