ZyXEL p-660h-61 User Guide
Prestige 660H Series User’s Guide
10-4
Firewalls
2. Weaknesses in the TCP/IP specification leave it open to "SYN Flood" and "LAND" attacks.
These attacks are executed during the handshake that initiates a communication session between
two applications.
two applications.
Figure 10-2 Three-Way Handshake
Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet
to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN,
and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is
established.
to the receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN,
and then the initiator responds with an ACK (acknowledgment). After this handshake, a connection is
established.
♦
SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK
that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is
known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes
back or when an internal timer (which is set at relatively long intervals) terminates the three-
way handshake. Once the queue is full, the system will ignore all incoming SYN requests,
making the system unavailable for legitimate users.
targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK
that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is
known as a backlog queue. SYN-ACKs are moved off the queue only when an ACK comes
back or when an internal timer (which is set at relatively long intervals) terminates the three-
way handshake. Once the queue is full, the system will ignore all incoming SYN requests,
making the system unavailable for legitimate users.
Figure 10-3 SYN Flood
♦
In a LAND Attack, hackers flood SYN packets into the network with a spoofed source IP
address of the targeted system. This makes it appear as if the host computer sent the packets to
itself, making the system unavailable while the target system tries to respond to itself.
address of the targeted system. This makes it appear as if the host computer sent the packets to
itself, making the system unavailable while the target system tries to respond to itself.
3. A
brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as
directed or subnet broadcasting, to quickly flood the target network with useless data. A Smurf
hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets
(pings). Since the destination IP address of each packet is the broadcast address of the network, the
router will broadcast the ICMP echo request packet to all hosts on the network. If there are
hacker floods a router with Internet Control Message Protocol (ICMP) echo request packets
(pings). Since the destination IP address of each packet is the broadcast address of the network, the
router will broadcast the ICMP echo request packet to all hosts on the network. If there are