In a SYN Flood, the source network sockets become totally random and overwhelming and at the same time the destination network sockets become much more narrowed. In extreme cases over 99% of the incoming packets are to one destination network socket.
