SYNfloods

SYNfloods are a type of denial-of-service (DoS) attack that targets the TCP handshake process. TCP, or Transmission Control Protocol, is a fundamental protocol for establishing reliable connections between devices on a network. When a client initiates a TCP connection, it sends a SYN (synchronize) packet to the server. The server responds with a SYN-ACK (synchronize-acknowledge) packet, and if the client is legitimate, it replies with an ACK (acknowledge) packet, completing the handshake.

In a SYNflood attack, the attacker sends a large volume of SYN packets to the target server, often with spoofed source IP addresses. The server, expecting a legitimate connection, allocates resources to each incoming SYN packet and sends back a SYN-ACK. However, because the source IP addresses are spoofed, the ACK packets never reach the server. This leaves numerous half-open connections, consuming the server's resources such as memory and CPU cycles. As the server's connection table fills up with these incomplete connections, it becomes unable to accept new, legitimate connection requests, effectively denying service to genuine users.

SYNflood attacks exploit the stateless nature of the initial SYN packet and the server's need to maintain state for the handshake. Mitigation strategies include implementing SYN cookies, which is a technique where the server sends a cryptographically generated cookie in the SYN-ACK response instead of allocating resources. If a valid ACK is received later, the server can reconstruct the connection details from the cookie. Other methods involve rate limiting SYN packets, filtering spoofed IP addresses, and using intrusion prevention systems.