312-50V11 · Question #687
When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must…
The correct answer is B. Attacker floods TCP SYN packets with random source addresses towards a victim host. A TCP SYN flood attack exploits the three-way handshake by sending SYN packets with spoofed source addresses, filling the victim's connection queue with half-open connections and denying service to legitimate users.
Question
When a normal TCP connection starts, a destination host receives a SYN (synchronize/start) packet from a source host and sends back a SYN/ACK (synchronize acknowledge). The destination host must then hear an ACK (acknowledge) of the SYN/ACK before the connection is established. This is referred to as the "TCP three-way handshake." While waiting for the ACK to the SYN ACK, a connection queue of finite size on the destination host keeps track of connections waiting to be completed. This queue typically empties quickly since the ACK is expected to arrive a few milliseconds after the SYN ACK. How would an attacker exploit this design by launching TCP SYN attack?
Options
- AAttacker generates TCP SYN packets with random destination addresses towards a victim host
- BAttacker floods TCP SYN packets with random source addresses towards a victim host
- CAttacker generates TCP ACK packets with random source addresses towards a victim host
- DAttacker generates TCP RST packets with random source addresses towards a victim host
How the community answered
(53 responses)- A17% (9)
- B70% (37)
- C4% (2)
- D9% (5)
Why each option
A TCP SYN flood attack exploits the three-way handshake by sending SYN packets with spoofed source addresses, filling the victim's connection queue with half-open connections and denying service to legitimate users.
Sending SYN packets toward random destination addresses scatters the attack and does not concentrate resource exhaustion on a single victim host.
The attacker floods the victim with SYN packets using randomized (spoofed) source IP addresses, causing the victim to allocate resources and send SYN/ACK responses to non-existent hosts. Because the final ACK never arrives, the connection queue fills entirely with half-open connections, exhausting memory and preventing legitimate TCP sessions from being established.
Flooding ACK packets does not initiate new entries in the SYN backlog queue and therefore does not exploit the three-way handshake vulnerability.
RST packets are used to tear down existing connections, not to fill the half-open connection queue used during SYN processing.
Concept tested: TCP SYN flood denial-of-service attack mechanism
Source: https://www.cisa.gov/sites/default/files/publications/Understanding_Denial-of-Service_Attacks.pdf
Topics
Community Discussion
No community discussion yet for this question.