AT2: SYN-ACK Flood
Definition
Host servers generate SYN-ACK packets in response to incoming SYN requests from clients. During a SYN-ACK flood, the victim server receives spoofed SYN-ACK packets at a high packet rate. This flood exhausts a victim’s server by depleting its system resources (memory, CPU, etc.) used to compute this irregularity, resulting in performance degradation or a complete server shutdown.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | None | Large | High | -- | -- | -- | -- | -- | -- |
Defense Fundamentals
Most SYN-ACK flood are generated by bots that spoof a large pool of IP addresses. The basic defense against this attack would be:
-
Detection by the source IP distribution
-
In cases where there is a high level of suspicion of a SYN-ACK flood, the RioRey system will start dropping sample SYN-ACK to observe proper TCP SYN-ACK retransmission.
-
Once an attack is detected, the normal defense is simply dropping all new incoming SYN-ACK and only allow retransmitted SYN-ACK to continue.
-
However, a sophisticated SYN-ACK flood attack would generate multiple SYN-ACK with the same Source/Destination IP pairs, mimicking a good TCP retransmission. In this case we recommend reducing the "maximum duplicates" setting which will prevent excessive spoofed retransmission.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor/ Force On/Off) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur in Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Force On (Requires RIOS>=8.4.2): Under Auto, packets undergo two distinct phases: detection and filtering. Once an attack has been detected, filtering is executed. In Force On mode, the detection phase is skipped and all packets are automatically filtered. Due to the required resources to perform this type of filtering, Force On can only be engaged for up to 64 distinct IP addresses. You can check the number of IP addresses a device is using this mode for on the Zone Management tab under Administration->Devices. In specific cases, this mode will increase the amount of packets filtered with an increased risk of false positives. Off: No filtering or monitoring is performed. |
| Disable flood mitigation (RIOS 5.3.0 or greater) | Unchecked | When this control is checked, flood detection and mitigation is turned off. The only checks that will be performed are for excessive duplicate packets (Subtype 2) and, if enabled, SYN-ACK packets with a data payload (Subtype 3). |
| Allow packets with payload (RIOS 5.3.0 or greater) | Disabled | When enabled, SYN-ACK packets with a payload will no longer be dropped automatically. |
| Maximum duplicates (RIOS 5.4.3 or greater) | 10 | This is the maximum allowed number of duplicate SYN-ACK packets from a source IP and port to the same destination IP and port (one session) before it will be considered an attack. Turning this to 0 will disable this check. |
| Allow start with zero window (RIOS 5.6.0 or greater) | Unchecked | A receiver opening a session is usually expected to be able to receive some amount of data immediately. The default behavior is to drop SYN-ACK packets with a window advertisement of 0. If this option is enabled, SYN-ACK packets with a window of 0 are allowed. |
| Validate ECN Flags (RIOS 8.4.0 or greater) | Disabled | Technically a wide variety of behavior is allowed for Explicit Congestion Notification (ECN). Enabling this control imposes stricter checks on SYN-ACK packets that most well behaved hosts would not send (reported as Subtype 5): - Drops if CWR = 1, ECE = 1 - Drops if CWR = 1, ECE = 0 |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT2 | 1 | Spoofed Flood Attack |
| AT2 | 2 | Excessive Duplicate Packets |
| AT2 | 3 | SYN-ACK Packets with Data Payload |
| AT2 | 4 | SYN-ACK with zero window |
| AT2 | 5 | SYN-ACK Packet with invalid ECN |
| AT2 | 6 | Duplicate SYN-ACK packet matches existing session |