Figure 91 Syn Flood - ZyXEL Communications Internet Security Appliance ZyWALL5UTM 4.0 User Manual

Figure 91 SYN Flood

• A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification
known as directed or subnet broadcasting, to quickly flood the target network with
useless data. A Smurf hacker floods a router with Internet Control Message Protocol
(ICMP) echo request packets (pings). Since the destination IP address of each packet is
the broadcast address of the network, the router will broadcast the ICMP echo request
packet to all hosts on the network. If there are numerous hosts, this will create a large
amount of ICMP echo request and response traffic. If a hacker chooses to spoof the
source IP address of the ICMP echo request packet, the resulting ICMP traffic will not
only clog up the "intermediary" network, but will also congest the network of the spoofed
source IP address, known as the "victim" network. This flood of broadcast traffic
consumes all available bandwidth, making communications impossible.
Chapter 10 Firewalls
response. While the targeted system waits for the ACK that follows
the SYN-ACK, it queues up all outstanding SYN-ACK responses on
what is known as a backlog queue. SYN-ACKs are moved off the
queue only when an ACK comes back or when an internal timer
(which is set at relatively long intervals) terminates the three-way
handshake. Once the queue is full, the system will ignore all
incoming SYN requests, making the system unavailable for
legitimate users.
b In a LAND Attack, hackers flood SYN packets into the network with
a spoofed source IP address of the targeted system. This makes it
appear as if the host computer sent the packets to itself, making the
system unavailable while the target system tries to respond to itself.
ZyWALL 5/35/70 Series User's Guide
202