What is SYN Flood ? How its Working ?

A SYN flood is an attack on a target system, specifically anattack in a key design attribute of the TCP/IP networkingprotocol.

In a SYN flood, the attacker sends thousands of SYN packets to a target system. A SYN packet is ordinarily a message sent from another computer that wants to establish a network connection with the target. Upon receiving the SYN, the target system will reply with a SYN/ACK, at which point the conversation will begin.

An important fact to note is that the target computer will allocate resources (mainly, memory) in anticipation of the new connection. But in a SYN flood, the attacker sends thousands of SYNs and ignores all the SYN/ACKs. The purpose of this is to flood the target system until it is incapable of communicating on any legitimate channels.A SYN flood is a special type of a denial of service attack.

These attacks are discussed in the next section.

How to Defeat it ?

micro blocks

Instead of allocating a complete connection object (which causes the memory failure), simply allocate a micro-record. Newer implementations allocate as little as 16-bytes for the incoming SYN object.

SYN cookies

Instead of allocating a record, send a SYN-ACK with a carefully constructed seqno generated as a hash of the clients IP address, port number, and other information. When the client responds with a normal ACK, that special seqno will be included, which the server then verifies. Thus, the server first allocates memory on the third packet of the handshake, not the first. However, the cryptographic hashing used in SYN cookies is fairly expensive, so servers that expect lots of incoming connections may choose not to use it. (Conversely, newer TCP stacks need to implement secure sequence numbers anyway in order to avoid TCP seqno prediction, so this is not necessarily a problem).

RST cookies

An alternative to SYN cookies, but may cause problems with Win95 machines and/or machines behind firewalls. The way this works is that the server sends a wrong SYNACK back to the client. The client should then generate a RST packet telling the server that something is wrong. At this point, the server knows the client is valid and will now accept incoming connections from that client normally.

stack tweaking

TCP stacks can be tweaked in order to reduce the effect of SYN floods. The most common example is to reduce the timeout before a stack frees up the memory allocated for a connection. Another technique would be to selectively drop incoming connections.