|
|
10.1 | |
TCP Operation | |
| 10.1.3 | |
Denial of service attacks |
|
Denial of service (DoS) attacks are
designed to deny services to legitimate hosts attempting to establish
connections. DoS attacks are a common method that hackers utilize to
halt system response. One type of DoS is known as SYN flooding. SYN
flooding exploits the normal three-way handshake and causes targeted
devices to ACK to source addresses that will not complete the
handshake. The three-way handshake begins when the
initiating host sends a synchronization (SYN) packet. The SYN packet
would include the source IP address and the destination IP address. This source and destination address
information is used by the recipient to send the SYN/ACK packet back
to the initiating device.
In a DoS attack, the hacker initiates a synchronization but spoofs the source IP address. Spoofing is a term used when the receiving device replies to a non-existent, unreachable IP address and then is placed in a wait-state while waiting to receive the final ACK from the initiator. The receiving device replies to a non-existent, unreachable IP address and then is placed in a wait state while waiting to receive the final ACK from the initiator. The waiting request is placed in a connection queue or a holding area in memory. This waiting state requires the attacked device to commit system resources, such as memory, to the waiting process until the connection timer times out. Hackers will flood the attacked host with these false SYN requests utilizing all of its connection resources to respond and wait for false connections, preventing it from responding to legitimate connection requests. To defend against these attacks, system administrators may decrease the connection timeout period and increase the connection queue size. Software also exists that can detect these types of attacks and initiate defensive measures.
|
Web Links