What is a SYN Attack ?
A SYN attack is an exploit of the TCP/IP stack whereby an attacker sends SYN packets and suppresses the SYN -ACK packet.
This type of attack can be Volumetric whereby the attacker sends a large amount of data to a link to saturate the link .
It can also be a trickle attack where the attack doesn’t generate a lot of bandwidth but ties up the resources on the devices.
See the below Image for an example of the process of a SYN-ATTACK
SYN attacks are a very common type of DDoS attack the SYN packet ties up a small amount of memory on the targets computer or network device.
This is also known as a half open connection where the connection is not fully established since it’s still waiting for the full handshake to occur.
These half open connections can eventually exhaust the resources on the device eventually leading to a crash.
Mitigation
To mitigate this type of attack you can rate limit SYN traffic per source also you can use mechanisms such as MOD Evasive for Apache servers to protect web servers.
For your Anti DDoS solution you may need to tweak settings if you are using NAT as it’s not unusual to see many SYN packets going to the single NAT address.
See the below video \
https://youtu.be/sZMl05ymqWI
Leave a Reply