Download presentation
Presentation is loading. Please wait.
1
SYN Flooding: A Denial of Service Attack Shivani Hashia CS265
2
Topics What is Denial of Service attack? Types of attacks SYN flooding attack Solutions Conclusion
3
What is Denial of Service Attack? Main aim to stop the victim’s machine from doing it’s required job Server unable to provide service to legitimate clients Damage done varies from minor inconvenience to major financial losses
4
Types of Attacks Bandwidth Consumption: All available bandwidth used by the attacker e.g.,ICMP ECHO attack Resource Consumption: Resources like web server, print or mail server flooded with useless requests e.g., mail bomb Network Connectivity: The attacker forces the server to stop communicating on the network e.g., SYN Flooding.
5
SYN Flooding Attack Network connectivity attack Most commonly-used DoS attack Launched with a little effort Presently, difficult to trace attack back to its originator Web servers and systems connected to Internet providing TCP-based services like FTP servers, mail servers are susceptible Exploits TCP’s three-way handshake mechanism and its limitations in maintaining half open connections
6
TCP Protocol: Three-way Handshake SYN Client requests for connection ACK + SYN Server agrees for connection request ACK Client finishes handshake SD Client connecting to TCP port LISTEN SYN_RCVD CONNECTED
7
Three-way Handshake SYN x SYN y +ACK x+1 ACK y+1 LISTEN SYN_RCVD CONNECTED SD Initialize sequence numbers for a new connection (x,y) Resources allocated
8
How SYN Flooding Attack Works? Client connecting to TCP port I have ACKed these connections but I have not received an ACK back! Resources allocated for every half open connection Victim Limit on number of half open connections SYN SYN + ACK Attacker Uses spoofed addresses
9
Attack Modes Different parameters by which SYN flood attack can vary: 1.Batch-size : Number of packets sent from source address in a batch 2.Delay : Time interval between two batches of packets sent 3.Source address allocation Single Address: Single forged address Short List: Small list to pick source addresses No List: Randomly created source addresses
10
Solutions Using firewall System configuration improvements SYN cache
11
Using Firewalls Two ways in which firewall used: Firewall as a relay: Packets from source received and answered by the firewall Firewall as a semi-transparent gateway: Lets SYN and ACK to pass, monitors the traffic and reacts accordingly
12
Firewall as a Relay SYN SYN+ACK A FIREWALLD Acts as a proxy Attack with Relay Firewall SYN+ACK SYN
13
Firewall as a Relay (cont’d) SYN SYN+ACK ACK SYN SYN+ACK ACK Data Sequence number conversion SFirewallD Legitimate connection with relay firewall
14
Firewall as Semi-transparent Gateway S Firewall D SYN SYN+ACK ACK RST Timeout
15
System Configuration Improvements 1) Decrease timeout period Reset the connections sooner Can deny legitimate access where the timeout period will be less than the round trip times 2) Increase the number of half-open connections More connections at the same time Will increase the use of resources
16
SYN Cache Global hash table instead of the usual per socket queued connections Protection from running out of the resources Limit on number of entries in the table and hash bucket Limit on the memory usage and amount of time taken to search for a matching entry
17
SYN Cache (cont’d) Queue is divided into hash buckets Each bucket treated as a First in First out Queue. Hash value computed by choosing a function of source and destination IP addresses, ports and a secret key Hash value acts as an index in the hash table. Secret key transforms hash value so that an attacker cannot target specific hash bucket and deny service to a specific machine
18
Conclusion SYN Flooding denial of service attack one of the most common attacks Caused by the flaws in TCP protocol Not possible to eliminate the attack Possible to reduce the danger by taking the described measures properly
19
Thank you
Similar presentations
© 2024 SlidePlayer.com. Inc.
All rights reserved.