ZyXEL 202H 91-003-194003B Manual Do Utilizador

P-202H Plus v2 User’s Guide

Chapter 8 Firewalls

80

• SYN Attack floods a targeted system with a series of SYN packets. Each packet causes 

the targeted system to issue a SYN-ACK response. While the targeted system waits for 
the ACK that follows the SYN-ACK, it queues up all outstanding SYN-ACK responses 
on what is known as a backlog queue. SYN-ACKs are moved off the queue only when an 
ACK comes back or when an internal timer (which is set at relatively long intervals) 
terminates the three-way handshake. Once the queue is full, the system will ignore all 
incoming SYN requests, making the system unavailable for legitimate users. 

Figure 28   SYN Flood

• In  a  LAND Attack, hackers flood SYN packets into the network with a spoofed source 

IP address of the targeted system. This makes it appear as if the host computer sent the 
packets to itself, making the system unavailable while the target system tries to respond 
to itself. 

7 A brute-force attack, such as a "Smurf" attack, targets a feature in the IP specification 

known as directed or subnet broadcasting, to quickly flood the target network with 
useless data. A Smurf hacker floods a router with Internet Control Message Protocol 
(ICMP) echo request packets (pings). Since the destination IP address of each packet is 
the broadcast address of the network, the router will broadcast the ICMP echo request 
packet to all hosts on the network. If there are numerous hosts, this will create a large 
amount of ICMP echo request and response traffic. If a hacker chooses to spoof the 
source IP address of the ICMP echo request packet, the resulting ICMP traffic will not 
only clog up the "intermediary" network, but will also congest the network of the spoofed 
source IP address, known as the "victim" network. This flood of broadcast traffic 
consumes all available bandwidth, making communications impossible.