SYN flooding (or TCP SYN flood) is a form of denial-of-service attack against systems that provide services over the Transmission Control Protocol (TCP). It exploits the way many TCP implementations handle incoming connection requests by causing a server to retain state for large numbers of incomplete (or “half-open”) connections, leaving insufficient resources to accept new legitimate connections. The attack typically targets a TCP service in the LISTEN state (such as a web or mail server). An attacker sends a rapid stream of TCP SYN packets, often using spoofed source IP addresses, so that the server replies with SYN-ACK packets and allocates resources for each pending connection, but does not receive the final ACK needed to complete the TCP three-way handshake. If enough such requests are received, the server's backlog of pending connections can be exhausted, causing legitimate connections to be rejected.
SYN refers to the SYN flag or SYN packet used in the TCP (Transmission Control Protocol) communication protocol. TCP is a widely used transport protocol that enables reliable and ordered delivery of data packets over IP networks. When establishing a TCP connection, the client and the server perform a three-way handshake. The SYN flag plays a crucial role in this handshake process.
The Three-Way Handshake
- SYN (Synchronize): In the first step of the three-way handshake, the client sends a TCP packet with the SYN flag set to the server. This packet is commonly known as the SYN packet. The SYN flag indicates the client’s intention to initiate a connection with the server.
- SYN-ACK (Synchronize-Acknowledge): Upon receiving the SYN packet, the server acknowledges the client’s request by sending back a TCP packet with both the SYN and ACK (acknowledge) flags set. This packet is called the SYN-ACK packet. It signifies the server’s agreement to establish a connection.
- ACK (Acknowledge): In the final step of the handshake, the client responds to the server’s SYN-ACK packet by sending an acknowledgment packet with the ACK flag set. This packet confirms the establishment of the TCP connection.
SYN Flood Attacks
- Mechanism: An attacker sends many SYN packets to a target server without completing the three-way handshake. This overwhelms the server’s resources and can lead to a denial of service for legitimate users.
- Mitigation: Defenses against SYN flood attacks include rate limiting, SYN cookies, and increasing the server’s backlog queue size. Network administrators may also use intrusion detection systems (IDS) and firewalls to filter out malicious SYN packets.
- Impact: Successful SYN flood attacks can degrade server performance, cause service outages, and disrupt legitimate user access to network resources.
