Analysis of a denial of service attack on TCP

Abstract

This paper analyzes a network-based denial of service attack for IF (Inteme.t Protocol) The paper contributes a detailed analysis of the SYN flooding attack and a discussion of existing and proposed countermeasures. Furthermore, we introduce a new solution approach, explain its design, and evaluate its perfonnance. Our approach offers protection against SYN flooding for all hosts connected to the same local area network, independent of their operating system or networking stack implementation. It is highly portable, configurable, extensible, and neither requires special hardware, nor modifications in routers or protected end systems.attacks cun be launched with little effort. Presently, it is difficult to trace an attack uack to its originator.Several possible solutions to this attack have been proposed by others, und some implemented. We have developed an active monitoring tool that classifies IP source addresses with high probability as being falsified or genuine. Our approach finds connection establishment protocol messages that are coming from forged IP addresses, and takes actions to ensure that the resulting illegitimate half-open connections arc reset immediately. This paper is organized as follows. Section 2 describes backgroWld material, such as the IP and TCP protocols. Section 3 explains the SYN flooding attack. Section 4 discusses existing approaches to solve this problem, such as configuration improvements and firewall-based approaches. The technical details of our approach are described in Section 5, followed by a performance evaluation in Section 6. Sections 7 and B outline future work issues and present conclusions.

Enhancing the Impregnability of Linux Servers

“…Once the target host's resources are tired, no more incoming TCP connections can be recognized, thus denying further legitimate access [7]. During SYN flood attacks, the attacker sends SYN packets with non existing source IP addresses [14].…”

Computer science and decision theory

“…In such applications, computations involving the data must be made during an initial scan as the data "stream" by. (See for example [20,70,91,92,93,94,95,219,259,387,415].) Herzog, Shenker, and Estrin [192] considered the problem of finding a "one-pass" mechanism to implement game-theory-based allocation schemes in multicasting.…”

Secure quality of service handling: SQoSH

“…It is presumed that administrative entities are trusted in either system, while policing is delegated; to hardware in the ATM setting, and to some lower layer through the Internet subnet-specific layer in the RSVP case. Some extensions for securing signaling are discussed by Schuba [9]. An additional limitation of these systems is that their policing is limited to bandwidth management.…”