What is a SYN flood attack?
A SYN Flood is a common form of Distributed-Denial-of-Service (DDoS) attack that sends a large amount of SYN requests to a server to overwhelm the open connections. These attacks can target any system connected to the Internet and providing Transmission Control Protocol (TCP) services (e.g. web server, email server, file transfer).
A SYN flood attack is a type of TCP State-Exhaustion Attack that attempts to consume the connection state tables present in many infrastructure components, such as load balancers, firewalls, Intrusion Prevention Systems (IPS), and the application servers themselves. This type of DDoS attack can take down even high-capacity devices capable of maintaining millions of connections.
What Are the Signs of a SYN Flood DDoS Attack?
A SYN Flood Attack occurs when the TCP layer is saturated, preventing the completion of the TCP three-way handshake between client and server on every port.
Every connection using the TCP protocol requires the three-way handshake, which is a set of messages exchanged between the client and server:
- The three-way handshake is initiated when the client system sends a SYN message to the server
- The server then receives the message and responds with a SYN-ACK message back to the client
- Finally, the client confirms the connection with a final ACK message
The purpose of this exchange is to validate the authenticity of each party and to establish the encryption key and options that will secure subsequent communications. This process must be completed before a communications port between the client and server can become fully open and available.
A TCP SYN flood DDoS attack occurs when the attacker floods the system with SYN requests in order to overwhelm the target and make it unable to respond to new real connection requests. It drives all of the target server’s communications ports into a half-open state.
Why is a SYN Flood DDoS Attack Dangerous?
Unlike other types of DDoS attacks, SYN flood DDoS attacks are not intending to use up all of the host’s memory, but rather, to exhaust the reserve of open connections connected to a port, from individual and often phony IP addresses. SYN floods are often called “half-open” attacks because this type of DDoS attack intends to send a short burst of SYN messages into the ports, leaving insecure connections open and available, and often resulting in a complete server crash.
How to Mitigate and Prevent a SYN Flood DDoS Attack
Firewalls and IPS devices, while critical to network security, are not adequate to protect against complex DDoS attacks. Today’s more sophisticated DDoS attack methodologies require a multi-faceted approach that enables users to look across both Internet infrastructure and network availability. Some of the capabilities to consider for stronger DDoS protection and faster mitigation of TCP SYN flood DDoS attacks include:
- Support of both inline and out-of-band deployment to ensure there is not one single point of failure on the network.
- Broad network visibility with the ability to see and analyze traffic from different parts of the network
- Varied sources of threat intelligence, including statistical anomaly detection, customizable threshold alerts and fingerprints of known or emerging threats in order to assure fast and accurate detection
- Scalability to manage attacks of all sizes, ranging from low-end (e.g., 1Gbps) to high end (e.g., 40Gbps)
How can NETSCOUT help?
NETSCOUT's Arbor DDoS solution has been protecting the world's largest and most demanding networks from DDoS attacks for more than a decade. We strongly believe that the best way to protect your resources from modern DDoS attacks is through a multi-layer deployment of purpose-built DDoS mitigation solutions.
Only with a tightly integrated, multi-layer defense can you adequately protect your organization from the full spectrum of DDoS attacks.
Arbor SP/Threat Mitigation System
NETSCOUT customers enjoy a considerable competitive advantage by getting both a micro view of their own network, via our products, combined with a macro view of global Internet traffic, via NETSCOUT Cyber Threat Horizon, an interface to our ATLAS threat intelligence and a DDoS Attack Map visualization.
Related Resources
State Exhaustion DDoS Attacks
Find out everything you need to know about state-exhaustion DDoS attacks and learn how to protect your network infrastructure.
Digital Attack Map
Click here to view a live global map of DDoS attack activity through NETSCOUT Cyber Threat Horizon.
ASERT Blog
Read the latest news and insights from NETSCOUT’s world-class security researchers and analysts.