Attack: denial of service, SYN floods and amplification
A denial-of-service attack steals nothing. It uses up a server's limited resources so real visitors are turned away. Watch forged SYNs fill a server's half-open backlog, a botnet overflow its link, and small forged DNS queries come back as answers 50 times bigger. The lesson explains how each attack works, then points to the defences that stop it.
5 quick questions
Pick an answer to see why. Your score saves with your progress.
01In a SYN flood, what does the attacker actually use up on the server?
Every SYN makes the server keep a record in the SYN-RECEIVED state until the ACK arrives. Forged SYNs never get that ACK, so they fill the backlog and real SYNs are dropped (RFC 4987).
02Why does the server never receive an ACK for the attacker's SYNs?
The attacker forges (spoofs) the source address. The server sends its SYN-ACK there, and nobody at that address is waiting to finish the handshake.
0310,000 bots each send 1 Mbit/s at a server with a 1 Gbit/s link. What happens?
10,000 × 1 Mbit/s = 10 Gbit/s. The link overflows before the server, and the routers cannot tell junk from real visitors.
04A 60-byte DNS query with a forged source address draws a 3,000-byte answer. Who gets the answer, and how much bigger is it?
UDP answers go to the source address in the packet, which the bot set to the victim's. 3,000 ÷ 60 = 50, inside the 28 to 54× range US-CERT measured for DNS.
05Which defence stops packets with forged source addresses from leaving the network they were sent from?
BCP 38 (RFC 2827) asks networks to drop packets whose source address could not have come from inside them. Without forged sources, SYN floods and reflection attacks lose their disguise.
Glossary
- Denial of service (DoS)
- An attack that uses up a service's resources so real users are turned away. Nothing is stolen; the service just stops.
- DDoS
- Distributed denial of service: the attack comes from many machines at once, so blocking one address does not help.
- Half-open connection
- A TCP connection in the SYN-RECEIVED state: the server has sent its SYN-ACK and is waiting for the ACK.
- Backlog
- The server's limited queue of half-open connections. When it is full, new SYNs are dropped.
- Spoofing
- Forging the source address of a packet. IP does not check who really sent it.
- Botnet
- Many hacked devices, often computers, cameras and home routers, controlled remotely by one attacker.
- Amplification
- Sending a small request that triggers a much bigger reply, so each attacking packet turns into more traffic at the victim.
- SYN cookies
- A defence where the server folds its record into the SYN-ACK instead of keeping it, so forged SYNs fill nothing.
Notes and sources
- Illustrative numbers: a 4-slot backlog (real servers hold hundreds or more), 10,000 bots at 1 Mbit/s against a 1 Gbit/s link, and a 60-byte DNS query drawing a 3,000-byte answer (50×, inside the 28 to 54× that US-CERT alert TA14-017A measured for DNS).
- 192.0.2.7, 203.0.113.10 and 192.0.2.53 are RFC 5737 documentation addresses; the forged sources come from 198.51.100.0/24, another documentation range.
- RFC 4987 describes the SYN flood: each SYN makes the server keep a record in SYN-RECEIVED, forged sources never send the ACK, and a full backlog drops new SYNs, real ones too.
- US-CERT alert TA14-017A lists bandwidth amplification factors for UDP protocols: DNS 28 to 54, NTP 556.9, and memcached 10,000 to 51,000.
- This lesson shows how the attacks work, not how to run them. The defence lesson that follows shows SYN cookies (RFC 4987), ingress filtering (BCP 38, RFC 2827), rate limiting and scrubbing working against them.
- RFC 4987: TCP SYN Flooding Attacks and Common Mitigations
- RFC 4732: Internet Denial-of-Service Considerations
- RFC 2827 (BCP 38): Network Ingress Filtering
- RFC 5358 (BCP 140): Preventing Use of Recursive Nameservers in Reflector Attacks
- CISA alert TA14-017A: UDP-Based Amplification Attacks
- RFC 9293: Transmission Control Protocol (TCP)
Quiz Unlocks after the last step.