a normal tcp packet shown in figure
How a TCP packet that causes dos attack different from normal Tcp Packet?
In the old days, there was a fun attack called the ping-of-death. It involves sending a ping packet larger than 65,535 bytes which will cause the target system to crash. This attack has been fixed for quite a while.
Generally, a denial of service attack occurs when a target system or application receives a packet containing data that it did not expect to receive and thus could not handle. The ping of death attack is an example of this. This sort of denial of service attack is becoming increasingly uncommon.
Another sort of denial of service attack is the distributed denial of service attack. This involves sending massive amounts of normal packets to a target system in the hopes of using up all the available bandwidth, thus locking out legitimate traffic. Most denial of service attacks are of this nature because it is incredibly simple to pull off and can easily be scaled to take down almost any target. See the recent Spamhaus' attack.
It doesn't differ, really. A denial of service usually involves a flood of packets, rather than a single malformed packet. There were a few attacks "back in the day", like the Ping of Death, which exploited vulnerabilities in the packet handling code on the target system, but these are (largely) a thing of the past.
In general, with a DoS attack, you'll find that thousands of SYN packets are sent in order to starve the system of resources. This can prevent legitimate users from connecting, since the system is trying to serve the fake clients.
Almost all DoS attacks doesn't use alternated network packages. This is because DoS attacks by alternating network packages is too specific so it is not widely used. In SYN attacks it only use a forged sender address.
Most DoS exploits service application, the network packages is the same as ordinary packages. This is because the DoS is trying to paralyse Internet service application by sending slow-to-process requests.
TCP packets "for DoS" are not different from TCP packets "not for DoS". The difference is in the intent.
A typical server, facing the Internet (e.g. a Web server), is ready to spend some of its precious resources (CPU, RAM...) on processing and responding to requests from anonymous clients. That's its function. The server is designed to act that way. Of course, these resources are not free; the people who paid for them do that because they believe that clients will use the server in a "normal way". For instance, for a Q&A site like
A typical denial-of-service is when many clients connect without respecting that agreement: the clients make a lot of requests and no human reads the responses. This makes the server spend resources "for nothing", and if there are sufficiently many such non-human clients, then the server no longer has sufficient resources to handle other normal, honest, human clients.
But this is all about the processing of the data once obtained on the client side. By nature, this is out of reach of the server. From the server point of view, these DoS request are not individually distinguishable from normal requests. To highlight the difference, consider the following situations:
Situation 1 is a plain DoS. So is situation 2, which is not distinguishable from situation 1 by simply looking at the packets. Situation 3, however, is not a DoS; the server owner will not react to it by whining and calling the Police; instead, the server owner will buy bigger servers and drink some champagne at the prospect of ten millions of potential customers. But, there again, there is no technical difference between situations 2 and 3, as can be seen from the server.
Practical defence against DoS involves heuristic ways to recognize situation 3 differently from situations 1 and 2. CAPTCHA, for instance, are used to make sure that a real human being is behind the keyboard, thus detected situation 1 (but not 2) (at least that's the intent; whether CAPTCHA work well is another question). Heuristic detection system will be effective at discriminating poorly done type 1 DoS, but they are easily defeated with a bit of competence and using a lot of distinct clients (the famous distributed denial-of-service attack).
In any case, DoS detection methods are not about analyzing one request, but about correlations between many requests. You will not find a bit in the TCP header which says "this is for a DoS, not for a normal human user". DoS, or not DoS, is a question defined over a big set of requests. Each individual request is identical to a normal "non-DoS" request.
These days, alot of layer 7 DoS attacks, and notice I say DoS meaning 1 computer are used.
So I'll give you an example, the beautiful slow loris incomplete GET request. You could connect to the HTTP server through TCP, and then send a incomplete HTTP GET request, causing the server to not timeout the connection because the idea is it thinks you are on some untrusted network, and wont timeout for long periods of time, like 400 seconds.
You just flood these, or even have these going at 1 per second, and the Apache server that has not got defence to this is finished.
So to answer your question: The TCP connection packet is not different, but what you send can be different, and can make a great difference, note the connection packet is still extremely important because its what connects you to the server. You just make the server not to timeout your connection, or do something shifty like that