TCP connection: Client → SYN → Server → SYN-ACK → Client → ACK → Connection Established. Each packet has a sequence number for ordering and acknowledgment.
SYN flood exploits the half-open connection state (SYN received, SYN-ACK sent, no ACK yet) — consuming server connection table. SYN cookies defend against this: server doesn't maintain state until ACK received. TCP FIN (graceful close) vs RST (immediate reset).