Client Request (SYN): When a client initiates a connection, it sends a SYN packet to the server.
Server Response (SYN-ACK): Instead of allocating resources and entering the normal three-way handshake process, the server generates a SYN cookie. This cookie contains information about the connection, including the initial sequence number and other details. The server then sends a SYN-ACK packet back to the client, but it does not allocate any resources for the connection yet.
Client Acknowledgment (ACK with SYN cookie): If the client is legitimate, it responds with an ACK packet that includes the SYN cookie generated by the server.
Connection Established: The server verifies the SYN cookie. If it is valid, the server establishes the connection, and communication proceeds as usual.