content: In the case of the syn floods I'm going to guess that they complete the syn-ack handshake on behalf of their customers before allowing the connection to be forwarded to the customer's network. They would need an enormous connection queue and bandwidth to be able to keep up with all the incoming requests and hold them until the handshake was complete or timed out. I would appreciate the correction if I'm wrong.