Chapter 02 Flashcards
What is TCP?
Transmission Control Protocol
What is a TCP SYN Flood Attack?
A type of denial-of-service attack that exploits the TCP handshake process by sending numerous SYN requests with forged source addresses
What are TCP SYN Cookies?
A mechanism to protect against SYN Flood attacks by generating an initial sequence number based on a hash function
What does the TCP 3-way handshake involve?
SYN, SYN-ACK, and ACK packets exchanged between a client and server for establishing a connection
Can an attacker with a spoofed source address successfully complete a TCP 3-way handshake?
Yes, but only if the attacker can receive the responses to the spoofed packets
What happens when an attacker sends TCP SYN packets with forged source addresses?
Bob’s connection table fills up with many half-opened connections, preventing legitimate users from establishing new TCP connections
How does Bob generate the initial sequence number α in SYN Cookies?
α = h(K, Ssyn) where K is a secret key and Ssyn is the source address of the SYN packet
What is the main advantage of using SYN Cookies?
The server does not need to allocate resources after receiving the first SYN packet
What is a disadvantage of using SYN Cookies?
Calculating α may be CPU consuming
Fill in the blank: The ACK/SEQ number in TCP is only _______ long.
32 Bit
What is the purpose of the ‘check_tcp_syn_cookie’ function?
To verify the received syncookie and ensure it is valid
What is the significance of the variable ‘count’ in the secure_tcp_syn_cookie function?
It increases every minute and is used in the calculation of the secure sequence number
True or False: TCP options cannot be negotiated when using SYN Cookies.
True
What cryptographic function is used in the Linux implementation of TCP SYN Cookies?
SipHash, a keyed hash function
What does the ‘tcp_cookie_time()’ function do?
It retrieves the current count for cookie generation based on time
What is the purpose of the ‘syncookie_secret’ in the Linux kernel?
It stores the secret key used for generating SYN Cookies
What is the implication of having a poorly implemented SYN Cookie mechanism?
It may be vulnerable to cryptoanalysis after receiving a sufficient number of cookies
What does the ‘tcp_max_syn_backlog’ parameter control?
It determines when to dynamically enable SYN Cookies in the Linux kernel
