Anatomy of an Attack: The Mechanics of a SYN Flood DDoS

A SYN flood is a type of Distributed Denial of Service (DDoS) attack that weaponizes the standard TCP three-way handshake, the process used to establish most internet connections. The attack hinges on overwhelming a server by initiating, but never completing, a massive number of connections. An attacker, typically using a botnet, sends a flood of SYN packets—the first step in the handshake—to a target server. Critically, these packets contain spoofed (fake) source IP addresses. The server, following protocol, responds to each of these requests with a SYN-ACK packet and allocates memory and resources for what it believes are pending connections. It places these in a backlog queue, creating a 'half-open' connection. Because the SYN-ACKs are sent to non-existent or unaware machines, the server never receives the final ACK packet to complete the handshake. The attacker sends these bogus requests faster than the server can time them out, causing the backlog queue to fill up completely. Once full, the server can no longer accept new connections, effectively denying service to legitimate users. While server-side tweaks like reducing timeouts can offer minimal help, the most robust defenses are SYN Cookies and third-party DDoS mitigation services. SYN Cookies use a cryptographic method to validate a connection before allocating resources, preventing backlog exhaustion. Mitigation services act as a frontline filter, absorbing and scrubbing the malicious traffic at a massive scale before it ever reaches the intended target, which is the standard for modern web infrastructure protection.

<h3>Introduction: Weaponizing a Handshake</h3> <p>In the digital world, nearly all meaningful communication, from loading a webpage to sending an email, begins with a simple, standardized greeting. For much of the internet, this greeting is the TCP (Transmission Control Protocol) three-way handshake. It's designed to be a reliable way for two computers to establish a connection. However, this fundamental process has a critical vulnerability that can be exploited to launch a powerful type of Distributed Denial of Service (DDoS) attack known as a SYN Flood. This attack doesn't break down a door; instead, it overwhelms the target by leaving it perpetually waiting for a conversation that will never begin.</p>

<h3>Prerequisite: Understanding the TCP Three-Way Handshake</h3> <p>Before dissecting the attack, one must first understand the legitimate process it corrupts. The TCP three-way handshake ensures that both the client (e.g., your computer) and the server are ready to exchange data. It proceeds in three steps:</p> <ol> <li><strong>SYN (Synchronize):</strong> The client wishing to start a connection sends a TCP packet with the SYN flag set to the server. This is akin to saying, "Hello, are you available to talk? I'd like to synchronize our connection parameters."</li> <li><strong>SYN-ACK (Synchronize-Acknowledge):</strong> If the server is available and willing to communicate, it responds with a TCP packet that has both the SYN and ACK (Acknowledge) flags set. This packet essentially says, "Yes, I am here and I acknowledge your request. I am also ready to synchronize." Crucially, at this point, the server allocates a small amount of memory and resources for this pending connection, placing it in a special queue (often called the backlog queue) and marking its state as <code>SYN_RECEIVED</code>. The server now waits for the final step.</li> <li><strong>ACK (Acknowledge):</strong> The client receives the server's response and completes the handshake by sending a final packet with the ACK flag set. This tells the server, "I have received your acknowledgment. The connection is now established." Upon receiving this ACK, the server moves the connection from the backlog queue to the list of fully established connections, ready for data transfer. The resources are now fully engaged.</li> </ol>

<h3>The Attack Mechanism: Exploiting the Waiting Game</h3> <p>A SYN flood attack exploits the second step of the handshake—the server's allocation of resources while it waits for the final ACK. The goal is to exhaust the server's capacity to handle new connections by filling its backlog queue with fake requests.</p> <p>Here is the step-by-step breakdown of the attack:</p> <ol> <li><strong>The Flood Begins:</strong> The attacker, often using a network of compromised computers called a botnet, begins sending a massive volume of SYN packets to the target server.</li> <li><strong>IP Address Spoofing:</strong> This is the key to the attack's success. The attacker does not use the real IP addresses of the compromised machines. Instead, they forge, or "spoof," the source IP address in each SYN packet. These spoofed addresses are typically random, non-existent, or belong to unreachable hosts.</li> <li><strong>The Server's Obligation:</strong> The target server receives this deluge of SYN packets. Behaving as designed, it dutifully processes each one. For every SYN packet, it sends a SYN-ACK response back to the spoofed source IP address and allocates resources for the new "half-open" connection, placing it in the backlog queue.</li> <li><strong>The Unanswered Call:</strong> Since the source IP addresses are fake, the server's SYN-ACK responses are sent to devices that either don't exist or never initiated a connection. Consequently, the final, crucial ACK packet is never sent back to the server.</li> <li><strong>Resource Exhaustion and Denial of Service:</strong> The server's backlog queue quickly fills with these half-open connections. Each one consumes a small amount of memory and a slot in the connection table. The server will wait for a predetermined amount of time (a timeout) for the final ACK before discarding the half-open connection. However, the attacker sends new spoofed SYN packets faster than the old ones can time out. Eventually, the backlog queue becomes completely full. At this point, any new, legitimate connection attempts from real users are dropped or ignored because the server has no more resources to allocate for them. The service is effectively denied to legitimate traffic.</li> </ol>

<h3>Real-World Impact and Mitigation Strategies</h3> <p>SYN floods have been a staple in the DDoS attacker's toolkit for decades and are a common component of massive, multi-vector attacks. For instance, the botnet Mirai, responsible for the record-breaking 2016 attacks on security journalist Brian Krebs and service provider Dyn, frequently utilized SYN floods among other attack vectors. The impact is direct: websites become unreachable, online services go down, and businesses suffer financial and reputational damage.</p> <p>Fortunately, several effective mitigation techniques exist:</p> <ul> <li><strong>SYN Cookies:</strong> This is a clever cryptographic defense. Instead of allocating memory upon receiving a SYN, the server encodes the connection details into a unique sequence number (the "cookie") and sends it in the SYN-ACK packet. The server then discards the initial SYN request. If the client is legitimate, it will return the cookie in its ACK packet. The server can then mathematically verify the cookie and reconstruct the connection, completely bypassing the need for a backlog queue for half-open connections.</li> <li><strong>Increasing Backlog and Reducing Timeouts:</strong> A more basic defense is to increase the size of the backlog queue to absorb more half-open connections and decrease the timeout period to clear them out faster. This is a limited solution that can be overwhelmed by a sufficiently large attack.</li> <li><strong>Cloud-Based DDoS Mitigation Services:</strong> The most common and effective modern defense is to route all network traffic through a specialized third-party service (like Cloudflare, Akamai, or AWS Shield). These providers operate massive global networks with the capacity to absorb and filter enormous DDoS attacks. They use sophisticated techniques, including SYN flood detection, to "scrub" the malicious traffic, ensuring that only legitimate user packets reach the origin server.</li> </ul>

Browse public study notes