Contents
What is the purpose of a SYN flood?
A SYN Flood is a common form of Denial-of-Service (DDoS) attack that can target any system connected to the Internet and providing Transmission Control Protocol (TCP) services (e.g. web server, email server, file transfer).
How do SYN flood attacks work?
In a SYN flood attack, the attacker sends repeated SYN packets to every port on the targeted server, often using a fake IP address. The server, unaware of the attack, receives multiple, apparently legitimate requests to establish communication. It responds to each attempt with a SYN-ACK packet from each open port.
How do you prevent a SYN flood?
SYN floods are a form of DDoS attack that attempts to flood a system with requests in order to consume resources and ultimately disable it. You can prevent SYN flood attacks by installing an IPS, configuring your firewall, installing up to date networking equipment, and installing commercial monitoring tools.
How does a SYN flood attack affect the server?
During a SYN flood attack, there is a massive disturbance of the TCP connection establishment: The attacker sends a SYN packet to the server and spoofs their IP address. The server creates a Transmission Control Block data structure for the half-open connection in the SYN backlog. The TCB uses memory on the server.
How does a reflection SYN flood attack work?
An attacker could take advantage of this to trigger a reflection SYN flood attack. The attacker spoofs the victim’s IP address, and starts a DDoS SYN flood against one or more uninvolved servers. Each of the servers responds to each incoming SYN packet with several SYN/ACK packets that are sent to the victim.
How is a SYN flood a denial of service?
SYN Flood. The attacker ( Mallory) sends several packets but does not send the “ACK” back to the server. The connections are hence half-opened and consuming server resources. Alice, a legitimate user, tries to connect but the server refuses to open a connection resulting in a denial of service.
How is a three way handshake initiated in a SYN flood?
1 The three-way handshake is initiated when the client system sends a SYN message to the server 2 The server then receives the message and responds with a SYN-ACK message back to the client 3 Finally, the client confirms the connection with a final ACK message