___________________________________________________________________
SYN
Flooding Torn Apart By Ankit Fadia [email protected]
___________________________________________________________________
Date
Released:
16th October 2001
Denial
Of Services Attacks or DOS Attacks have these days become very common. Almost
all servers are bound to be under a DOS Attack some time of the other. If one
needs a one-line definition of a DOS Attack, then the following would best describe
it: An attack on a target system by a malicious system to render the normal
services offered by it to legitimate users as unavailable. For a more detailed
look into DOS Attacks and various examples read: http://hackingtruths.box.sk/dos.htm
In
this manual, we will be focusing on one of the most common and easiest to
execute DOS Attacks, known as SYN Flooding. SYN Floods are not only a very
popular form of DOS attacks, but they are also one of the steps, which one has
to take to successfully perform IP Spoofing. This manual talks about SYN
Flooding in detail, giving the various malicious ways in which it can be
misused and the countermeasures, that one can take to prevent one’s system from
falling prey to such attacks.
The
basic underlying concept behind SYN flooding is flooding the target system with
so many connection requests coming from spoofed source Addresses such that all
its memory gets hogged up, in trying to establish full, proper connections with
all these connection requests. In effect, since all the memory of the target
system is used up in trying to establish connections with spoofed source
addresses, which do not actually exist, the target system is thus not able to
provide services to even legitimate users or clients.
Did you still not get as to what SYN Flooding
means? Consider the following real life scenario: Say there is a single
telephone connection with 10 parallel lines i.e. the same number has 10 lines.
If you use 10 telephones and dial this particular number 10 times, once each
from each telephone, then all the 10 parallel lines of the target telephone
would be used up in answering your 10 calls. Thus, even if there were any
legitimate clients trying to call up the number (which is under attack by you),
then he would not be able to get through. Thus as a result, we can say that the
services of the target telephone have been rendered unavailable. SYN Flooding
is even better than the above scenario, as in the former the connection
requests are from spoofed source addresses, thus making it difficult (not
impossible) for the target system to trace the source of the attack.
Similarly,
in a SYN Flood Attack, the target system is flooded with endless number of
connection requests, so that all of its memory is hogged up, thus rendering the
services provided by the system unavailable to legitimate users. To understand
SYN Flooding better, read further.
The
SYN attack exploits TCP/IP's three-way handshake. Thus in order to understand as
to how SYN Attacks work, one needs to first know how exactly TCP/IP establishes
a connection between two systems. Whenever a client wants to establish a
connection with a host, then three steps take place. These three steps are
referred to as the three-way handshake.
1. The client system sends a SYN Packet (Synchronization Packet) to the remote host
2. The remote host replies with a SYN/ACK Packet (Synchronization/Acknowledgement Packet) to the client.
3. The client replies with an ACK Packet, acknowledging the packet sent by the host in Step 2.
****************
HACKING TRUTH: What exactly are ACK and SYN Packets?
TCP/IP
in its bid to ensure proper and safe transfer of data from the client to the
host demands that both the source and destination must transmit and receive
acknowledgement messages, that confirms the safe and proper transfer of data.
These acknowledgement messages are known as ACK messages.
Let
us take an example to understand ACK messages in a better manner. Say there are
2 systems A and B. Let us assume that A sends a packet (say X1) to B. Now, A
will not send the second packet (i.e. X2) to B, unless and until it receives an
acknowledgement (i.e. ACK X1) from B acknowledging the receipt of the first
packet X1. Thus, we can say that A will not send the second packet unless and
until B acknowledges the receipt of the first packet. Thus ensuring proper
transfer of data from the source to the destination.
The
destination will not send more requests for data unless it gets the ACK from
Source confirming that the ACK X1was received by it. If the source does not get
an ACK message from the destination, then something, which is called a
timed-out, occurs and the source (A) will resend the data to destination (B).
An
ACK message of 1000 would mean that all data up to 1000 octets has been
received till now. There is also something known as NACK, but we would not be
going into that in this manual.
A
SYN Packet is nothing but a normal TCP packet with the Synchronize (SYN) flag
switched on. A packet with the SYN flag switched on basically means that the
sender of the SYN packet wants to establish a three- way TCP/IP connection with
the destination system.
*****************
To
understand the three-way handshake better, let us follow the below depiction of
the 3 steps-:
In the first step the client sends a SYN packet to the host, with whom it wants to establish a three-way connection. The SYN packet requests the remote system for a connection. It also contains the Initial Sequence Number or ISN of the client, which is needed by the host to put back the fragmented data in the correct sequence. Data sent over the Internet is broken down at the sender’s end and put back together at the receiver’s end, and it is in this process that ISN comes into play.
In
the second step, the host replies to the client with a SYN/ACK packet. This
packet acknowledges the SYN packet sent by the client and sends the client its
own ISN.
In
the last step the client acknowledges the SYN/ACK packet sent by the host by
replying with an ACK packet.
These
three steps together are known as the 3-way handshake and only when they are
completed is a complete TCP/IP connection established between the source and
the destination. After a complete handshake has taken place, the connection
thus established is called a fully established connection.
In a SYN attack, several SYN packets are sent to the server but all these SYN packets have a bad source IP Address. When the target system receives these SYN Packets with Bad IP Addresses, it tries to respond to each one of them with a SYN ACK packet. Now the target system waits for an ACK message to come from the bad IP address. However, as the bad IP does not actually exist, the target system never actually receives the ACK packet. It thus queues up all these requests until it receives an ACK message. The requests are not removed unless and until, the remote target system gets an ACK message. Hence these requests take up or occupy valuable resources of the target machine. As a result, due to such a large number of connection requests, the memory of the target system gets hogged up, thus it is unable to cater to requests for information made by legitimate users.
It is important to note that to actually affect the target system, a large number of SYN packets having bad IP addresses have to be sent. As these packets have a Bad Source IP, they queue up, use up resources and memory of the target system and eventually crash, hang or reboot the system.
In
accordance with the rules of TCP/IP, after a certain time has passed, a ’timed
out’ takes place and the connection requests queued up by the target system
are discarded, thus a part of the hogged up memory gets freed up. However, in a
typical SYN Flooding Attack, the attacker keeps on sending connection requests
from spoofed addresses at a rate faster than a ‘timed out’ of the
earlier connection requests can take place (A “Timed Out” forces the earlier
connection requests to get discarded.) As a result, even though due to ‘timed
out’ the queued up connection requests are being discarded, the memory of the
target system does not get freed up, as the attacker is continuously sending
more and more spoofed connection requests.
****************
HACKING TRUTH: SYN
Packets in conjugation with the concept of half open connections are used for
stealth port scanning or half open port scanning. For more details read: http://hackingtruths.box.sk/portscan.htm
****************
When
the target system has sent the SYN ACK packet to the client, who had tried to
establish a connection, and it is waiting to receive an ACK from this
particular client, then the existing connection is said to be a half open
connection or the host is said to be in the state of SYN_RECEIVED. It is this
state, that one can use to detect whether his system is under SYN floods are
not. Simply type in the following Netstat command at the prompt: (The
parameters passed and the results in this case would vary from system to
system)
C:\windows>netstat
-a
Active
Connections
Proto Local Address Foreign Address State
TCP
ankit
201.xx.34.23 SYN_RECEIVED
TCP
ankit
197.xx.21.31 SYN_RECEIVED
TCP
ankit
1.xx.91.66 SYN_RECEIVED
TCP
ankit 151.xx.45.0 SYN_RECEIVED
TCP
ankit 187.xx.71.98 ESTABLISHED
TCP
ankit 197.xx.11.41 SYN_RECEIVED
TCP
ankit *:* SYN_RECEIVED
TCP ankit *:* ESTABLISHED
……….
If
the above command, when executed on your system shows you a lot of connections
in the SYN_RECEIVED state, then it probably means that your system is under a
SYN Flood Attack. It is important to note that in the above output, there are
indeed some connections in the state of ‘Established’. They basically are
legitimate connections, which remain unaffected even after the SYN flood attack
on the target system.
We
now know the working of SYN Attacks and how to detect whether or not your system
is under a SYN flood attack or not. Let us now learn the countermeasures, which
can be taken against such attacks.
There
is no single countermeasure to protect your system against SYN Flood attacks.
However, there are certain sets of steps, which can be followed to minimize the
risk of damage caused by such attacks-:
SYN
Flooding is also commonly used in the process of performing IP Spoofing. We
would be discussing IP Spoofing in later manuals. With this we come to the end
of this manual. Hope you enjoyed it. Till next time, bye.
Ankit Fadia
To receive
tutorials written by Ankit Fadia on everything you ever dreamt of in your
Inbox, join his mailing list by sending a blank email to: [email protected]
Wanna
ask a question? Got a comment to make? Criticize, Comment and more…..by sending
me an Instant Message on MSN Messenger. The ID that I use is: [email protected]
Wanna
get 1500+ pages of valuable information? Wanna be a part of a ‘only for
members’ mailing list? Get it all by simply joining The Hacking Truths
club by clicking Here
Take
the HTCH examination to give recognition to your Hacking Skills. Click Here