So lets say someone sends a lot of SYN requests to a server by spoofing IP, before receiving the ack from the client, does the server reserves the connection's Window size in its memory? if not, then what are the resources that are being wasted here, if the client sends a lot of SYN requests without sending the ACK? what resources does the server reserves when getting an ACK from a Client?
Also i have seen that when a router gets flooded with TCP SYN requests(for port 22/SSH for example) the CPU usage goes very high, but i don't understand why, isn't the response to a SYN request packet pretty straight forward? aren't routers and servers built in a way that they can respond to SYN request packets pretty fast with low cpu usage considering SYN request packets are very common?