SYN Flooding Attack
SYN Flooding Attack
A SYN flooding attack is a type of Denial-of-Service (DoS) attack that exploits the TCP three-way connection establishment process.
The main idea is that the attacker sends a large number of SYN requests to a TCP server but does not complete the connection establishment. As a result, the server has to keep resources reserved for many incomplete connections.
1. Normal TCP Connection Establishment
Normally, TCP establishes a connection using three steps:
Client Server | | | -------- SYN --------------> | | | | <------ SYN + ACK ---------- | | | | -------- ACK --------------> | | | Connection established
The three steps are:
-
Client → Server: SYN
- Client requests a TCP connection.
- The client provides its initial sequence number.
-
Server → Client: SYN + ACK
- Server accepts the request.
- Server acknowledges the client's SYN.
- Server provides its own initial sequence number.
-
Client → Server: ACK
- Client acknowledges the server's SYN.
- The TCP connection is established.
2. What Happens in a SYN Flooding Attack?
In a SYN flooding attack, an attacker sends a large number of SYN segments to the server.
The attacker makes these requests appear to come from different clients by faking (spoofing) the source IP addresses.
For example:
Fake Client 1 ─── SYN ───> Server Fake Client 2 ─── SYN ───> Server Fake Client 3 ─── SYN ───> Server Fake Client 4 ─── SYN ───> Server . . . Fake Client N ─── SYN ───> Server
The server assumes that these are legitimate connection requests.
3. Server Allocates Resources
For every SYN received, the server starts the TCP connection-establishment process.
It allocates resources such as:
- Transfer Control Block (TCB)
- Connection-state information
- Timers
- Memory for maintaining the incomplete connection
The server then sends a SYN + ACK back to the supposed client.
Attacker Server | | | -------- SYN -----------> | | | | <------ SYN + ACK --------| | | | No ACK | | |
The problem is that the supposed client address is fake, so the SYN + ACK generally does not result in the expected third step.
4. The Third Step Never Arrives
The server is now waiting for:
ACK
from the client.
But because the source addresses were forged, the expected ACK does not arrive.
The server therefore keeps the connection information and waits for the connection-establishment process to complete.
During this period, the resources allocated to the incomplete connection remain occupied.
5. Server Resources Become Exhausted
Now imagine the attacker sends thousands of SYN requests:
SYN 1 ──────> Server SYN 2 ──────> Server SYN 3 ──────> Server SYN 4 ──────> Server SYN 5 ──────> Server . . . SYN 10000 ──> Server
For each request, the server allocates resources and waits for the final ACK.
Eventually:
Large number of SYN requests ↓ Many incomplete TCP connections ↓ Server allocates resources ↓ Resources become exhausted ↓ Legitimate clients cannot establish connections
Thus, the server may become unable to accept connection requests from valid clients.
6. Why Is It Called a DoS Attack?
DoS = Denial of Service
The objective is to prevent legitimate users from accessing the service.
The attacker does not necessarily need to gain access to the server. Instead, the attacker monopolizes the server's resources with a large number of connection requests.
Therefore:
SYN flooding is a Denial-of-Service attack in which an attacker sends a large number of SYN requests, causing the server to maintain many incomplete TCP connections and eventually exhaust its resources.
7. Complete Attack Sequence
The complete process can be represented as:
SYN requests ┌─────────────────────┐ │ │ ↓ ↓ Fake Client 1 Fake Client 2 │ │ └─────────┬───────────┘ ↓ TCP Server │ Allocates resources Creates TCB entries Starts timers │ ↓ Sends SYN + ACK │ ↓ No final ACK arrives │ ↓ Incomplete connections │ ↓ Resources are consumed │ ↓ Resources exhausted │ ↓ Legitimate clients denied service
8. How Can SYN Flooding Be Reduced?
There are several strategies.
1. Limit connection requests
The server can impose a limit on the number of connection requests accepted during a specified period.
Maximum SYN requests ↓ Limit exceeded ↓ Additional requests restricted
2. Filter unwanted source addresses
The system can attempt to identify and filter datagrams originating from unwanted or suspicious source addresses.
3. Use Cookies
A more recent strategy mentioned in the textbook is to postpone resource allocation until the server can verify that the connection request is legitimate.
This uses a mechanism called a cookie.
The basic idea is:
SYN ↓ Server verifies request ↓ Cookie mechanism ↓ Client proves it received the response ↓ Resources allocated
This prevents the server from immediately allocating substantial resources for every incoming SYN request.
The SCTP uses this type of strategy.
9. SYN Flooding vs Normal TCP Connection
| Normal TCP | SYN Flooding |
|---|---|
| Client sends SYN | Attacker sends many SYNs |
| Server sends SYN + ACK | Server sends SYN + ACK for many requests |
| Client sends final ACK | Final ACKs do not arrive |
| Connection is established | Connections remain incomplete |
| Resources are released/used normally | Resources remain occupied |
| Legitimate communication proceeds | Server resources may be exhausted |
| Normal service | Legitimate clients may be denied service |
Key point to remember
SYN flooding exploits the period between the server sending SYN + ACK and receiving the client's final ACK. By creating a large number of such incomplete connections, the attacker can consume the server's resources and cause a Denial of Service.
Comments
Post a Comment