312-50 Question 227
Single answer▪ DoS/DDoS ConceptsA company launches a public web portal and soon notices intermittent outages. During each outage, the firewall logs show tens of thousands of inbound TCP packets to the web server on port 80, all with the SYN flag set and spoofed-looking source IP addresses from many different networks. The server's TCP half-open connection queue becomes exhausted, preventing legitimate users from connecting. As the security analyst, you need to identify the attack and recommend the most appropriate immediate mitigation. Which option is the best answer?
- A
The server is experiencing a TCP SYN flood DDoS attack; enable SYN cookies or use a SYN proxy/load balancer to protect the backlog queue
- B
The server is experiencing an ICMP smurf attack; disable ICMP echo replies on the web server to stop the traffic
- C
The server is experiencing an HTTP GET flood; increase the web application's thread pool size to absorb the requests
- D
The server is experiencing an ARP poisoning attack; clear the ARP cache on the web server and gateway
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a TCP SYN flood, a common DoS/DDoS technique that abuses the TCP three-way handshake by sending many SYN packets and failing to complete the connection. Because the victim keeps state for half-open sessions, the backlog queue can fill, blocking legitimate clients. In real environments, immediate mitigations include SYN cookies at the operating system level, SYN proxying on network security devices or load balancers, rate limiting where appropriate, and engaging an ISP or cloud DDoS scrubbing provider for upstream filtering. This aligns with standard TCP/IP behavior described in RFC 793 and SYN cookie defenses documented in operating system and network vendor guidance. The distinguishing factors are the SYN-only traffic, spoofed source IPs, and exhaustion of half-open connections, which differentiate it from ICMP amplification, HTTP application-layer floods, or LAN-based ARP attacks.
- A. Correct.
Correct. A large volume of SYN packets, spoofed source addresses, and exhaustion of the half-open connection queue are classic indicators of a TCP SYN flood. In this attack, the target allocates resources for incomplete TCP handshakes until the backlog is full. Practical mitigations include enabling SYN cookies on the host OS, using a SYN proxy on a firewall/load balancer, and upstream DDoS filtering. This directly addresses the protocol weakness being abused.
- B. Incorrect.
Incorrect. A smurf attack relies on ICMP echo requests sent to directed broadcast addresses with the victim's spoofed source IP, causing many hosts to reply to the victim. The scenario specifically describes TCP SYN packets to port 80 and backlog exhaustion, which does not match ICMP-based amplification. Disabling ICMP echo replies on the web server would not solve the immediate TCP state exhaustion problem.
- C. Incorrect.
Incorrect. An HTTP GET flood targets the application layer after successful TCP connections are established and typically appears as apparently valid HTTP requests. The key evidence here is exhaustion of the TCP half-open queue from SYN packets, meaning the attack is occurring before full HTTP processing. Increasing the thread pool may help with some application-layer load issues, but it does not mitigate SYN backlog exhaustion.
- D. Incorrect.
Incorrect. ARP poisoning is a local network attack used to manipulate Layer 2 address resolution, often for man-in-the-middle interception or local denial of service within the same broadcast domain. It does not explain high volumes of spoofed TCP SYN packets arriving from many networks on the internet. Clearing ARP cache entries would not address this external distributed attack pattern.