SSCP Systems Security Certified PractitionerNetwork and Communications SecurityMedium
A security technician is investigating a network performance issue where legitimate users are experiencing slow access to a critical web application. Analysis shows an abnormally high number of half-open TCP connections to the web server. Which type of attack is likely occurring, and what is the common mitigation strategy?
- AHTTP Flood; deploy a Web Application Firewall (WAF).
- BSmurf Attack; disable ICMP echo reply on routers.
- CDNS Amplification; implement DNSSEC.
- DSYN Flood; enable SYN cookies or increase connection limits.
Show answer & explanationAnswer & explanation
Correct answer: D. SYN Flood; enable SYN cookies or increase connection limits.
An abnormally high number of half-open TCP connections is a classic symptom of a SYN Flood attack. This attack exploits the TCP three-way handshake by sending SYN requests without completing the ACK. Mitigation strategies include enabling SYN cookies, increasing the backlog queue size, or using specialized hardware.
Why the other options are wrong
- A. HTTP Flood attacks send many legitimate-looking HTTP requests; a WAF can help, but the symptom described is specific to TCP connection establishment, not HTTP requests.
- B. Smurf attacks use ICMP to flood a target; disabling ICMP echo reply helps, but doesn't relate to half-open TCP connections.
- C. DNS Amplification uses DNS servers to flood a target; DNSSEC secures DNS, but doesn't directly mitigate this specific attack type.
SYN Flood Attack
A type of denial-of-service (DoS) attack that exploits the TCP three-way handshake by sending a flood of SYN requests to a server, but never sending the final ACK, leaving the connections half-open and exhausting server resources.
- Targets the TCP three-way handshake.
- Leaves connections in a 'half-open' state.
- Exhausts server connection tables and memory.
Memory trick: Symptoms Reveal The Attack, Solutions Provide Relief.