Figure 9-2 Three-Way Handshake; Figure 9-3 Syn Flood - ZyXEL Communications ZyWALL 5 User Manual

ZyWALL 5 Internet Security Appliance
2. Weaknesses in the TCP/IP specification leave it open to "SYN Flood" and "LAND" attacks.
These attacks are executed during the handshake that initiates a communication session between
two applications.
Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet
to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN,
and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is
established.
SYN Attack floods a targeted system with a series of SYN packets. Each packet causes
2-a
the targeted system to issue a SYN-ACK response. While the targeted system waits for the
ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what
is known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes
back or when an internal timer (which is set at relatively long intervals) terminates the three-
way handshake. Once the queue is full, the system will ignore all incoming SYN requests,
making the system unavailable for legitimate users.
In a LAND Attack, hackers flood SYN packets into the network with a spoofed source IP
2-b
address of the targeted system. This makes it appear as if the host computer sent the packets to
itself, making the system unavailable while the target system tries to respond to itself.
3. A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as
directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf
hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets
9-4

Figure 9-2 Three-Way Handshake

Figure 9-3 SYN Flood

Firewalls