Thank you for Subscribing to Telecom Business Review Weekly Brief
Telecom Business Review | Tuesday, April 13, 2021
TCP SYN flood (or SYN flood) is a type of DDoS(Distributed Denial of Service) attack that exploits part of the regular TCP three-way handshake to use up resources on the targeted server and render it unresponsive.
FREMONT, CA: With SYN flood DDoS, the criminal sends TCP connection requests faster than the targeted machine can process, causing network saturation.
Attack description
Stay ahead of the industry with exclusive feature stories on the top companies, expert insights and the latest news delivered straight to your inbox. Subscribe today.
When a client and server institute a normal TCP “three-way handshake,” the exchange looks like this:
1. The client requests a connection by sending an SYN (synchronize) message to the server.
2. The server acknowledges this by sending an SYN-ACK (synchronize-acknowledge) message to the client.
3. The client replies with an ACK (acknowledge) message and establishes the connection.
In an SYN flood attack, the attacker sends recurrent SYN packets to every port on the targeted server, often utilizing a fake IP address. Unaware of the attack, the server receives multiple legitimate requests to establish communication. It responds to each attempt with an SYN-ACK packet from each open port.
The malicious client either does not transmit the expected ACK or—if the IP address is spoofed—never accommodates the SYN-ACK in the first place. However, the server under attack will wait for acknowledgment of its SYN-ACK packet for some time.
Progression of an SYN flood.
During this time, the server cannot shut down the connection by sending an RST packet, and the connection stays open. However, another SYN packet will arrive before the connection can time out. This leaves a progressively large number of connections half-open – and SYN flood attacks are also called “half-open” attacks. Ultimately, as the server’s connection overflow tables fill, service to legitimate clients will be denied, and the server may even malfunction or crash.
While the “classic” SYN flood explained above tries to drain network ports, SYN packets can also be used in DDoS attacks that try to clog your pipes with fake packets to achieve network saturation. Again, the type of packet is not important. Still, SYN packets are often used since they are the least likely to be rejected by default.
Methods of mitigation
While modern operating systems are better prepared to manage resources, which makes it harder to overflow connection tables, servers are still vulnerable to SYN flood attacks.
There are several common abilities to mitigate SYN flood attacks, including:
Micro blocks—administrators can assign a micro-record (as few as 16 bytes) in the server memory for each incoming SYN request instead of a total connection object.
SYN cookies—using cryptographic hashing, the server transmits its SYN-ACK response with a sequence number (seqno) constructed from the client IP address, port number, and possibly other uniquely identifying information. When the client responds, this hash is incorporated into the ACK packet. The server verifies the ACK and just then allocates memory for the connection.
RST cookies—The server intentionally sends an invalid SYN-ACK for the first request from a provided client. This should result in the client producing an RST packet, which tells the server something is wrong. If this is received, the server perceives the request is legitimate, logs the client, and accepts subsequent incoming connections.
Stack tweaking—administrators can pinch TCP stacks to mitigate the effect of SYN floods. This can entail reducing the timeout until a stack frees memory allocated to a connection or selectively dropping incoming connections.
All the methods mentioned above depend on the target network’s ability to handle large-scale volumetric DDoS attacks, with traffic volumes measured in tens of Gigabits (and even hundreds of Gigabits) per second.
More in News