SYN scan victim sending back RST

Question

I'm confused on the case of SYN scan and closed ports (the case of open ports makes sense). So, the attacker sends a ~40 byte SYN packet, a "closed port" would send a RST packet back to the attacker and is thus "unexploitable". Does this mean that the attacker can't send another SYN packet to the closed port to continue attempting to flood it? Or does that just mean that this port is unexploitable by other means but another SYN packet can be sent and the attacker can continue the process forever?

Answer 1

It depends on what the attacker is trying to accomplish.

Usually the goal with a network scan, is to identify active hosts on a network, and what services they offer. Either for the purpose of attacking them or for network security assessment.

You're describing a SYN flood attack, which is different than a scan.

A SYN flood occurs when a host sends a flood of TCP/SYN packets, often with a forged sender address. Each of these packets is handled like a connection request, causing the server to spawn a half-open connection, by sending back a TCP/SYN-ACK packet (Acknowledge), and waiting for a packet in response from the sender address (response to the ACK Packet). However, because the sender address is forged, the response never comes. These half-open connections saturate the number of available connections the server is able to make, keeping it from responding to legitimate requests until after the attack ends.

In the case the port is actually closed, you won't get any half-open connections, but you could possibly saturate the targets connection with packets, which would be a denial of service attack as well.

Answer 2

In a "SYN flood" attack, the attacker wants to make the target server allocate resources to handle apparent connection attempts. The attacker sends SYN packets which tell to the server "I want to connect to port n". If there is, on the server, some software which currently expects incoming connections on port n, then the server responds with a ACK+SYN packet and, more importantly, reserves some RAM on the server to maintain the state associated with the alleged new client. However, if there is no software listening on port n, the server respond with a RST (which some firewall may or may not drop, by the way), and reserves no RAM.

It is not the sending of the RST which makes the attack fail; what makes it fail is that the server reserves no RAM in that case. The server will not drown under the half-open connections since it forgets them immediately.

If the attacker receives a RST packet, then he knows that his flooding attempt is ineffective, but that's just a byproduct. Note that the main advantage of the SYN flood attack (advantage for the attacker) is that the attacker needs not receive any response from the server, so he may use fake source addresses (that's called IP spoofing), which helps him covering his tracks. If the source address is spoofed, the attacker, by construction, never sees any response packet from the server, be it ACK+SYN or RST.

Answer 3

• Basically you are mixing up two different phases of hacking methodology. Purpose of a syn scan is not to attack but to gather information (pre-atttack phase) and flooding would be carrying out a real attack once you have found out a vulnerability.

• The purpose of port scanning is to find out the open ports and applications listening on those ports. Basically discovering exploitable communication channels.

• If the port is closed there is no communication channel. The port will not accept any kind of packets.

Flooding attack is an attack that attempts to cause a failure in a computer system or other data processing entity by providing more input than the entity can process properly

• If you keep sending syn packets to a closed port (like you mentioned) it can not be considered as flooding as your packets are not being accepted by an application. You may be flooding the bandwidth by generating a large number of syn packets.

Answer 4

Yes, you can continue to send SYN packets to a closed port all you want, but at that point you'll just be exhausting bandwidth.

Exhausting system resources is done with systems that actually respond and allocate resources such as memory to expected subsequent interactions, so that type of attack isn't possible with closed ports.

Just keep in mind there are numerous types of DoS: some bandwidth, some system resources, etc.