312-50 Question 233
Single answer▪ DoS/DDoS Attack TechniquesA company hosts a public web application behind a stateful firewall. During a disruption, the security team observes a very large number of TCP packets arriving at the web server with the SYN flag set, but very few completing the TCP three-way handshake. The firewall's connection table is rapidly filling, causing legitimate users to be dropped even though total bandwidth usage is not saturated. As the ethical hacker reviewing the incident, which attack technique best explains this behavior?
- A
TCP SYN flood attack
- B
UDP amplification attack using open DNS resolvers
- C
HTTP GET flood against the application layer
- D
Smurf attack using ICMP echo requests to a broadcast address
Show answer and explanation
Correct answer: A
Explanation
This scenario describes a classic TCP SYN flood, a transport-layer DoS technique that targets the state-management behavior of servers, firewalls, and load balancers. In normal TCP operation, a client sends SYN, the server replies with SYN-ACK, and the client completes the handshake with ACK. In a SYN flood, the attacker sends many SYNs but does not complete the final ACK, often using spoofed source IP addresses. This causes half-open connections to accumulate until backlog queues or state tables are exhausted, denying service to legitimate clients. This is distinct from volumetric attacks such as DNS or NTP amplification, which aim to saturate bandwidth, and from application-layer floods such as HTTP GET floods, which usually involve completed TCP sessions. Defensive guidance commonly recommended by vendors and standards bodies includes SYN cookies, rate limiting, increasing backlog handling carefully, anti-spoofing measures aligned with BCP 38, and upstream DDoS mitigation or scrubbing services.
- A. Correct.
Correct. A TCP SYN flood abuses the TCP handshake by sending large numbers of SYN packets and either never replying to the SYN-ACK responses or spoofing source addresses. This leaves many half-open connections on the target or intermediate stateful devices such as firewalls and load balancers. The scenario specifically mentions many SYN packets, few completed handshakes, and exhaustion of the connection table rather than link saturation, which is characteristic of a SYN flood.
- B. Incorrect.
Incorrect. A UDP amplification attack using open DNS resolvers is a reflection/amplification DDoS technique that typically produces a very large volume of UDP traffic and is often associated with bandwidth saturation. The scenario instead describes TCP SYN packets and exhaustion of state tables due to incomplete handshakes, which does not match DNS amplification behavior.
- C. Incorrect.
Incorrect. An HTTP GET flood targets the application layer by sending what appear to be legitimate HTTP requests, often over fully established TCP connections. While it can overwhelm web servers, it does not primarily present as large numbers of SYN packets with incomplete TCP handshakes. A candidate might choose this because it is a common web DoS method, but the packet-level evidence in the scenario points lower in the stack.
- D. Incorrect.
Incorrect. A Smurf attack relies on ICMP echo requests sent to a network broadcast address with the victim's spoofed source IP, causing many hosts to reply to the victim. Although it is a classic DoS technique, it involves ICMP rather than TCP SYN packets and would not specifically explain a firewall's TCP connection table filling with half-open sessions.