Common Flooding Attacks
The most common attack, called the TCP SYN attack, floods the service with TCP SYN packets. For each SYN packet received, the server allocates resources for a new incoming session and sends back a TCP ACK packet. An attacker simply ignores this (or the source address was spoofed, so the reply goes to max hop-count oblivion on the Internet). After a while, the server runs out of session resources and stops answering requests.
Variants of the TCP SYN attack disrupt other TCP states, such as LAST-ACK, FIN-WAIT-1, and so on. Also, in many cases, flooding existing connections can disrupt or take down a connection.
In some cases, it is possible to use new features in the various operating systems (OS) to help mitigate these attacks. Examples include enabling SYN cookies in Linux or activating the SynAttackProtect parameter in Microsoft Windows 2000 and Windows 2003 Server OSs.
Another type of flooding attack is to generate lots of small packets and send them to a server under attack. Routers and switches must spend a certain amount of time processing each packet, and there is a limit on the number of packets each device can process each second. This is usually specified as kilopackets per second (Kpps) or megapackets per second (Mpps).
For example, a typical low-end enterprise router has a forwarding rate of about 100 Kpps. A typical high-end Linux PC can easily generate up to 400 Kpps of small packets, which easily overwhelms the router, even if the bandwidth that the packets use does not fill the bandwidth link.
The last type of attack used is to generate many large packets and send them to a server under attack. Often, the servers being attacked are connected through medium-speed links to the Internet (10 or 100 Mbps). If the links are filled with junk traffic, legitimate traffic cannot pass.
Continue reading here: Anatomy of a Switch
Was this article helpful?