Figure 105 Three-Way Handshake; Figure 106 Syn Flood - ZyXEL Communications Vantage CNM User Manual

Vantage CNM User's Guide

Figure 105 Three-Way Handshake

Under normal circumstances, the application that initiates a session sends a SYN
(synchronize) packet to the receiving server. The receiver sends back an ACK
(acknowledgment) packet and its own SYN, and then the initiator responds with an ACK
(acknowledgment). After this handshake, a connection is established.

Figure 106 SYN Flood

213
a
SYN Attack floods a targeted system with a series of SYN packets.
Each packet causes the targeted system to issue a SYN-ACK
response. While the targeted system waits for the ACK that follows
the SYN-ACK, it queues up all outstanding SYN-ACK responses on
what is known as a backlog queue. SYN-ACKs are moved off the
queue only when an ACK comes back or when an internal timer
(which is set at relatively long intervals) terminates the three-way
handshake. Once the queue is full, the system will ignore all
incoming SYN requests, making the system unavailable for
legitimate users.
b In a LAND Attack, hackers flood SYN packets into the network with
a spoofed source IP address of the targeted system. This makes it
appear as if the host computer sent the packets to itself, making the
system unavailable while the target system tries to respond to itself.
Chapter 12 Configuration > Firewall