The server repeatedly waits, then retransmits the SYN-ACK packet to the spoofed IP address when no response comes. This process ties up server resources. In addition, the server's processor must generate the SYN-ACK packets and the network must accommodate the bandwidth necessary to send and receive packets. By flooding the server with spoofed SYN packets during a short period of time, the perpetrator can overwhelm the server. Memory fills up so that none is available for legitimate traffic, and the server hangs, crashes or reboots.
Backups are a good example.
Every three months, I hold a drill in which I randomly pick a file, a set of files or an entire client company's database and have our administrators restore either the latest backup or a backup from an off-site archive to a specified location. Our SLA regarding backups dictates that we will restore a company's data within a certain period of time or we must pay the company a remedy. The remedy might mean a free month of service or a cash payout. I also perform fire drills to test the reaction of our network operations analysts to security events. In the past, I usually did something like attempting to log in to a server as a root a bunch of times - like 50 times.