Analysis of a denial of service attack on TCP

This paper analyzes a network-based denial of service at-tack for IP (Internet Protocol) based networks. It is popu-larly called SYN flooding. It works by an attacker sending many TCP (Transmission Control Protocol) connection re-quests with spoofed source addresses to a victim’s machine. Each request causes the targeted host to instantiate data structures out of a limited pool of resources. Once the target host’s resources are exhausted, no more incoming TCP con-nections can be established, thus denying further legitimate access. The paper contributes a detailed analysis of the SYN flooding attack and a discussion of existing and proposed countermeasures. Furthermore, we introduce a new solu-tion approach, explain its design, and evaluate its perfor-mance. Our approach offers protection against SYN flood-ing for all hosts connected to the same local area network, independent of their operating system or networking stack implementation. It is highly portable, configurable, exten-sible, and requires neither special hardware, nor modifica-tions in routers or protected end systems. 1