| 10.1 |  | TCP Operation |
| 10.1.3 |  | Denial of service attacks |

| Denial of service (DoS) attacks are designed to deny services to legitimate hosts attempting to establish connections. DoS attacks are a common method that hackers utilize to halt system response. One type of DoS is known as SYN flooding. SYN flooding exploits the normal three-way handshake and causes targeted devices to ACK to source addresses that will not complete the handshake. The three-way handshake begins when the initiating host sends a synchronization (SYN) packet. The SYN packet would include the source IP address and the destination IP address. This source and destination address information is used by the recipient to send the SYN/ACK packet back to the initiating device. In a DoS attack, the hacker initiates a synchronization but spoofs the source IP address. Spoofing is a term used when the receiving device replies to a non-existent, unreachable IP address and then is placed in a wait-state while waiting to receive the final ACK from the initiator. The receiving device replies to a non-existent, unreachable IP address and then is placed in a wait state while waiting to receive the final ACK from the initiator. The waiting request is placed in a connection queue or a holding area in memory. This waiting state requires the attacked device to commit system resources, such as memory, to the waiting process until the connection timer times out. Hackers will flood the attacked host with these false SYN requests utilizing all of its connection resources to respond and wait for false connections, preventing it from responding to legitimate connection requests. To defend against these attacks, system administrators may decrease the connection timeout period and increase the connection queue size. Software also exists that can detect these types of attacks and initiate defensive measures.
| Web Links Denial of Service (DoS) Attack Resources http://www.denialinfo.com/