As a result, legitimate users lose access to the service.
How a SYN Flood Attack Works
A three-step process is used to establish a TCP connection:
- The client sends a SYN.
- The server responds with SYN-ACK.
- The client confirms the connection with ACK.
After this, the connection is considered established.
During the attack, the attacker sends a large number of SYN requests to the server but never completes the connections. Upon receiving a SYN, the server reserves space for a new connection and waits for an ACK confirmation. The half-open TCP session queue fills up, and the server stops accepting connections from real users.
Attackers often spoof IP addresses to complicate filtering and conceal the attack source. Such attacks actively use botnets, compromised IoT devices, and rented DDoS platforms.
Protection Methods
One of the primary defense mechanisms is SYN cookies. This technology allows the server to avoid storing connection state until a valid ACK is received.
Additionally used:
- rate limiting;
- stateful firewall;
- anti-DDoS systems;
- spoofed traffic filtering;
- DPI analysis of TCP sessions.
In large infrastructures, SYN Flood is typically filtered at the provider or edge router level.
Learn more about how attacks work and how a telecom operator can protect against them in our article SYN Flood Attack: Areas of Responsibility and Practical Protection.
