dosd vs tcp

Author: patriciasantaana

src/content/docs/ddos-protection/frequently-asked-questions.mdx

@@ -118,9 +118,20 @@ You can then adjust the [sensitivity level](/ddos-protection/managed-rulesets/ht
 
 Refer to the guide on how to [create an override](/ddos-protection/managed-rulesets/http/configure-dashboard/#create-a-ddos-override).
 
-The use of expression fields is subject to [availability](#availability). 
+The use of expression fields is subject to [availability](/ddos-protection/#availability). 
+
+---
 
 ## Does Cloudflare charge for DDoS attack traffic?
 
 No. Since 2017, Cloudflare offers [free, unmetered, and unlimited DDoS protection](https://blog.cloudflare.com/unmetered-mitigation/). There is no limit to the number of DDoS attacks, their duration, or their size. Cloudflare's billing systems automatically exclude DDoS attack traffic from your usage. 
 
+---
+
+## How does DDoS Protection determine whether a SYN flood attack is mitigated by `dosd` or Advanced TCP Protection?
+
+Cloudflare mitigates SYN flood packets statelessly in `dosd` or using [DDoS managed rules](/ddos-protection/managed-rulesets/) when it detects a pattern that indicates that the packet is fake. 
+
+When SYN flood packets are highly randomized or indistinguishable from legitimate packets, Cloudflare uses [Advanced TCP Protection](/ddos-protection/advanced-ddos-systems/overview/advanced-tcp-protection/) to protect your site.
+
+