352-001 · Question #125
Which resource does a TCP SYN flood attack target?
The correct answer is A. connection tables on the target host. A TCP SYN flood exhausts the half-open connection state table on the target host by sending SYN packets without completing the three-way handshake.
Question
Which resource does a TCP SYN flood attack target?
Options
- Aconnection tables on the target host
- Bsend buffers on transit routers
- Cshared memory on the routers closest to the target
- DSYN cookies on the target host
How the community answered
(63 responses)- A92% (58)
- B2% (1)
- C2% (1)
- D5% (3)
Why each option
A TCP SYN flood exhausts the half-open connection state table on the target host by sending SYN packets without completing the three-way handshake.
Each unanswered SYN causes the target to allocate a Transmission Control Block (TCB) entry and wait for the final ACK. Flooding with SYNs fills the finite connection table with half-open entries, preventing legitimate connections from being established until entries time out.
Transit routers do not buffer SYN packets waiting for handshake completion; they simply forward them and are not the resource exhausted.
Shared memory on transit routers is not involved in tracking TCP connection state for the target host.
SYN cookies are a defensive countermeasure that encodes state into the sequence number to avoid allocating a TCB, making them a mitigation technique rather than an attack target.
Concept tested: TCP SYN flood attack mechanism and target resource
Source: https://www.cisco.com/c/en/us/about/security-center/synflood.html
Topics
Community Discussion
No community discussion yet for this question.