RE: syn flooding attack and bandwidth consumation

When a server receives a syn packet on an open port, it sends back a syn/ack packet, and then allocates a certain amount of server resources to handle the client request. A syn flood only sends syn packets, and will not reply with an ack after the server sends back its syn/ack. The theory behind the attack is to force the server to allocate all its resources to the bogus requests. It requires relatively few syn packets to flood the server, and so your bandwidth usually will not be flooded, just the server. Note that although a syn attack does not *need* to consume all of your bandwidth to flood your server, there is nothing to stop overkill on the syn packets flooding your network anyway.

Benjamin Meade
Systems Administrator
LanWest Pty Ltd Received on Sat Nov 9 03:16:29 2002