TCP-Attacks

Question 1

What is TCP SYN flood attack?

Answer 1

Since TCP needs 3 way handshake to initiate the connection, an attacker can send SYN packets with forged source addresses, when the victim replies to those source addresses, he does not receive anything back from them because they did not initiate the connection. This will fill up many half opened connections in bobs connection table.

Question 2

How can we protect ourselves from TCP SYN flood attack?

Answer 2

TCP SYN Cookies.
Instead of having a connection table, this time Bob (the victim) calculates the initial sequence number like a = h(K,Ssyn) where K is a secret key, Ssyn is the source address of the SYN packet (first packet) and sends it with the ACK flag (second packet).
When Bob receives the third packet, he can check whether the ACK flag equals a+1, if so, he can make sure that the client sent a SYN message earlier.

Question 3

What are the advantages and disadvantages of the TCP SYN Cookie?

Answer 3

Adv:
1.No need to allocate resources after the first SYN packer.
2.Syn cookies dont require changes in the specification of the TCP protocol.
3.The client dont have to be aware that the server is using SYN cookies.

Disadv:
1.Calculating a may be cpu consuming
2.ACK/SEQ number are only 32 bit long