PrepAway - Latest Free Exam Questions & Answers

What happens during a SYN flood attack?

What happens during a SYN flood attack?

PrepAway - Latest Free Exam Questions & Answers

A.
TCP connection requests floods a target machine is flooded with randomized source address &
ports for the TCP ports.

B.
A TCP SYN packet,which is a connection initiation,is sent to a target machine,giving the target
host’s address as both source and destination,and is using the same port on the target host as
both source and destination.

C.
A TCP packet is received with the FIN bit set but with no ACK bit set in the flags field.

D.
A TCP packet is received with both the SYN and the FIN bits set in the flags field.

Explanation:
To a server that requires an exchange of a sequence of messages. The clientsystem begins by
sending a SYN message to the server. The server thenacknowledges the SYN message by
sending a SYN-ACK message to the client. Theclient then finishes establishing the connection by
responding with an ACKmessage and then data can be exchanged. At the point where the server
systemhas sent an acknowledgment (SYN-ACK) back to client but has not yet receivedthe ACK
message,there is a half-open connection. A data structuredescribing all pending connections is in
memory of the server that can bemade to overflow by intentionally creating too many partially
openconnections. Another common attack is the SYN flood,in which a target machine isflooded
with TCP connection requests. The source addresses and source TCP ports of the connection
request packets are randomized; the purpose is to force the target host to maintain state
information for many connections that will never be completed. SYN flood attacks are usually
noticed because the target host (frequently an HTTP or SMTP server) becomes extremely
slow,crashes,or hangs. It’s also possible for the traffic returned from the target host to cause
trouble on routers; because this return traffic goes to the randomized source addresses of the
original packets,it lacks the locality properties of “real” IP traffic,and may overflow route caches.
On Cisco routers,this problem often manifests itself in the router running out of memory.

One Comment on “What happens during a SYN flood attack?


Leave a Reply