Lesson 51 · Network security: attacks and defences

Defence: SYN cookies, rate limiting and scrubbing

Floods can knock a server offline. Here you watch them fail. Follow one server, 203.0.113.10, as SYN cookies keep its half-open queue empty, a rate limiter caps each source, open resolvers are closed, providers drop forged addresses, and scrubbing centres with anycast soak up floods too big for any one link.

12 min11 steps5 questionsBeginner

Fig 51 · Interactive

Loading figure…

or ← →

Check yourself

5 quick questions

Pick an answer to see why. Your score saves with your progress.

01With SYN cookies on, what does the server store when a SYN arrives?

The cookie is a hash of the addresses, ports, a coarse clock and a secret, sent as the server's starting sequence number. The server keeps no state, so a SYN flood cannot fill its queue.

02Why does a per-source rate limit not stop a SYN flood with random forged source addresses?

Rate limiting works on sources that send a lot, such as bots completing real handshakes from their true addresses. Spread over thousands of fake addresses, the flood slips under it; SYN cookies, BCP 38 and scrubbing handle that.

03An attacker sends a small DNS query to an open resolver with the source forged to 203.0.113.10. Why does closing the resolver stop this reflection?

Reflection needs a helper that answers anyone with a reply much bigger than the question (28 to 54 times for DNS). A closed resolver (RFC 5358) refuses outsiders, so the forged query gets only a small refusal and the server receives no flood.

04The bots' provider assigned their line 198.51.100.0/24. A packet leaves that line with source 203.0.113.10. What does BCP 38 tell the edge router to do?

Ingress filtering (RFC 2827) only lets out packets whose source address belongs to the network they come from. Forged sources are stopped before they reach the internet, which also stops reflection.

05A flood is ten times bigger than the server's internet link. Which defence can still help?

Once the link is full, nothing at the server can help: good packets are lost before they arrive. Upstream networks with huge capacity, spread over many anycast sites, filter the flood and forward only clean traffic.

Key terms

Glossary

Half-open connection: A TCP connection that has received a SYN and sent a SYN-ACK but is still waiting for the final ACK.
SYN cookie: A server's starting sequence number made from a hash of the connection details and a secret, so it needs to store nothing until the final ACK arrives.
Rate limiting: Counting requests or new connections from each source and dropping those above a set limit.
Spoofing: Putting a false source address in a packet so it seems to come from someone else.
BCP 38: Best Current Practice 38 (RFC 2827): networks drop outgoing packets whose source address does not belong to them.
Open resolver: A DNS resolver that answers queries from anyone on the internet, which lets attackers use it as a reflector.
Scrubbing centre: A network with very large links that receives a site's traffic during an attack, drops the attack and forwards the rest.
Anycast: Announcing the same address from many sites, so each packet goes to the nearest one and a flood is split between them.

Fine print

Notes and sources

Illustrative numbers: a 4-slot half-open queue (real ones are far larger), a limit of 20 new connections per second, and a cookie of 7341092; real cookies look random.
203.0.113.10, 192.0.2.7, 192.0.2.53 and 198.51.100.0/24 are RFC 5737 documentation addresses; the server and user are the same pair as in the TCP and HTTPS lessons.
SYN cookies are described in RFC 4987 §3.6 and Appendix A. Linux, for example, by default sends cookies only while the queue is overflowing, because a cookie cannot carry every TCP option (window scaling, selective ACK) unless timestamps hold them.
BCP 38 (RFC 2827) protects other people, not the network that deploys it; spoofing stops only as more providers filter. Unicast reverse path forwarding (BCP 84, RFC 3704) is a common way to apply it.
A per-source limit cannot stop a flood with forged, random sources (each address sends little), which is why cookies, BCP 38 and scrubbing are needed too.

Quiz Unlocks after the last step.