AT6: Synonymous IP
Definition
A victim receives spoofed packets of any protocol at a high rate that have the victim's IP address specified as both the Source IP and the Destination IP. Well-configured firewalls will correctly discard these packets, which makes them primarily useful in link saturation attacks ("filling the pipe", so to speak). However, if a TCP Synonymous IP attack packet reaches a server, it will cause the server to send either a SYN-ACK or an ICMP "port closed" response to itself (assuming the attack uses SYN packets), depending on whether or not there is a service listening on that port. At that point, the session does not continue being created because no ACK is sent in reply to the SYN-ACK. Other TCP packets will not result in a response. UDP packets will either generate an ICMP "port closed" response (again, to itself), or no response if there is a service listening on that port. ICMP packets may generate a relevant ICMP response to itself (for example, a ping will trigger a response).
In cases where responses are generated, the resources required to create the response are wasted, possibly resulting in performance degradation or a complete server shutdown. Although the packet's Source and Destination IP are identical in a Synonymous IP attack, the payload is mostly irrelevant because the server responses, in cases where a response is generated, are primarily based on the Destination Port.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | If TCP | Single IP | High | Variable | -- | -- | -- | -- | -- |
Defense Fundamentals
This attack requires no adjustment. Once turned on, the zone will drop all packets with Source IP = Destination IP. This is a non-persistent mitigation, meaning all drops are evaluated and filtered on a per packet basis.
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |
Subtypes
Attack packets are classified under subtypes for better reporting. The subtype and reason the packet is labeled as invalid under its attack type can be found in the following table.
| Attack Type | Subtype | Details |
|---|---|---|
| AT6 | 1 | Other Packet |
| AT6 | 2 | TCP Packet |
| AT6 | 3 | UDP Packet |
| AT6 | 4 | ICMP Packet |