A SYN flood is a form of
denial-of-service attack
In computing, a denial-of-service attack (DoS attack) is a cyber-attack in which the perpetrator seeks to make a machine or network resource unavailable to its intended users by temporarily or indefinitely disrupting services of a host conn ...
in which an attacker rapidly initiates a connection to a server without finalizing the connection. The server has to spend resources waiting for half-opened connections, which can consume enough resources to make the system unresponsive to legitimate traffic.
The
packet
Packet may refer to:
* A small container or pouch
** Packet (container), a small single use container
** Cigarette packet
** Sugar packet
* Network packet, a formatted unit of data carried by a packet-mode computer network
* Packet radio, a fo ...
that the attacker sends is the
SYN packet, a part of
TCP's
three-way handshake
The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network implementation in which it complemented the Internet Protocol (IP). Therefore, the entire suite is commonly ...
used to establish a connection.
Technical details
When a client attempts to start a
TCP connection to a server, the
client
Client(s) or The Client may refer to:
* Client (business)
* Client (computing), hardware or software that accesses a remote service on another computer
* Customer or client, a recipient of goods or services in return for monetary or other valuabl ...
and
server
Server may refer to:
Computing
*Server (computing), a computer program or a device that provides functionality for other programs or devices, called clients
Role
* Waiting staff, those who work at a restaurant or a bar attending customers and su ...
exchange a series of messages which normally runs like this:
#The client requests a connection by sending a
SYN (''synchronize'') message to the server.
#The server ''acknowledges'' this request by sending
SYN-ACK back to the client.
#The client responds with an
ACK, and the connection is established.
This is called the
TCP three-way handshake, and is the foundation for every connection established using the TCP protocol.
A SYN flood attack works by not responding to the server with the expected
ACK code. The malicious client can either simply not send the expected
ACK, or by
spoofing the source
IP address
An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...
in the
SYN, cause the server to send the
SYN-ACK to a falsified IP address – which will not send an
ACK because it "knows" that it never sent a
SYN.
The server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing
ACK. However, in an attack, the ''
half-open connection Half-open may refer to:
* Half-open file in chess
* Half-open vowel, a class of vowel sound
Computing and mathematics
* Half-open interval, an interval containing only one of its endpoints
* Half-open line segment, a line segment containing on ...
s'' created by the malicious client bind resources on the server and may eventually exceed the resources available on the server. At that point, the server cannot connect to any clients, whether legitimate or otherwise. This effectively denies service to legitimate clients. Some systems may also malfunction or crash when other operating system functions are starved of resources in this way.
Countermeasures
There are a number of well-known countermeasures listed in RFC 4987 including:
#Filtering
#Increasing backlog
#Reducing SYN-RECEIVED timer
#Recycling the oldest
half-open TCP
#SYN cache
#
SYN cookies
#Hybrid approaches
#Firewalls and proxies
See also
*
Fraggle attack
A Smurf attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address. ...
*
Internet Control Message Protocol
*
IP address spoofing
In computer networking, IP address spoofing or IP spoofing is the creation of Internet Protocol (IP) packets with a false source IP address, for the purpose of impersonating another computing system.
Background
The basic protocol for sending ...
*
Ping flood
A ping flood is a simple denial-of-service attack where the attacker overwhelms the victim with ICMP "echo request" ( ping) packets. This is most effective by using the flood option of ping which sends ICMP packets as fast as possible without wa ...
*
Smurf attack
A Smurf attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address. ...
*
UDP flood attack
A UDP flood attack is a volumetric denial-of-service (DoS) attack using the User Datagram Protocol (UDP), a sessionless/connectionless computer networking protocol.
Using UDP for denial-of-service attacks is not as straightforward as with the Tr ...
References
External links
Official CERT advisory on SYN Attacks
{{DEFAULTSORT:Syn Flood
Denial-of-service attacks