Abstract: In this paper, the characteristics of SYN flooding attack are explored, some key metrics of judging this kind of attack are proposed. Thereafter, an introduction of the architecture of network measurement system is introduced. Then the detecting method with the features of service-protected and attack-removed, the method of tracing the source of attack are expatiated in detail. Finally, the experiments for validating the mechanisms of detecting and tracing attacks are given.