Q: A DDoS attack is targeting your application, overwhelming it with fake SYN packets (SYN Flood). How do you mitigate this at the infrastructure and OS levels?

A SYN flood exhausts the server's TCP connections by sending SYN packets but never responding to the SYN-ACK, leaving half-open connections in the kernel's queue until it drops legitimate traffic.

• Infrastructure Level: I would move the application behind a Layer 4/7 edge protection network like AWS Shield/WAF, Cloudflare, or an AWS ALB. These services independently handle the TCP handshake and only pass fully established HTTP connections to the backend, completely absorbing the SYN flood.
• OS Level: If it's a bare-metal server, I would enable SYN Cookies via sysctl -w net.ipv4.tcp_syncookies=1. This tells the Linux kernel to stop allocating memory for half-open connections and instead encode the connection state cryptographically into the SYN-ACK sequence number, verifying it only if the final ACK arrives.