What is the difference between an SYN-Flood attack and an SYN-ACK-Flood attack?

Question

What is the difference between an SYN-Flood attack and an SYN-ACK-Flood (SYN Reflection) attack?

Answer 1

An explanation of how each attack works, it is really helpful if u have a small background knowledge of TCP protocol

SYN flood :

1)The attacker sends multiple SYN packets at all server-victim's port forging his IP address

2)Server replies at all SYN requests with a SYN+ACK for each open port and a RST for closed ports.The connection is now "Half-open" and the server expects a ACK response from the client to establish the connection into an "open" one

3)The attacker never responds to the SYN+ACK leaving the connection at a "Half-open" state (usually 75 seconds until server terminates the TCP connection). The server has built in its system memory a data structure describing all pending connections. This data structure is of finite size, and it can be made to overflow by intentionally creating too many partially-open connections, then the system will be unable to accept any new incoming connections until the table is emptied out.

Reflection attacks are used on challenge-response authentication systems using the same protocol in both directions, tricking the target system to provide the answer to its own challenge and i don't think there's a SYN reflection attack

SYN-ACK Flood :

The attacker sends spoofed SYN-ACK packets that do no belong to any current session within the server.This can lead to resource exhaustion of any state-full mechanisms, like firewall,ips,ids or the server, which will try to do a look-up for every incoming SYN-ACK request .

This attack can be amplified with a botnet sending SYN packets to servers on the internet with the victims IP spoofed as the sender. Each server will respond with a SYN-ACK redirected back to the victims server generating large numbers of SYN-ACK packets.

Answer 2

Other people have made some great answers to what an SYN-Flood attack and an SYN-ACK-Flood attack are. I just want to add

Reflection SYN Attack

In a SYN reflection attack, the attacker usually has a list of valid IP (or will start by making one, this would be very easy to do), where if you send a [SYN] packet, there will be a responding [SYN, ACK]. So what the attacker will do, it go through this list of IP-addresses, and send a [SYN] packet with a spoofed source address matching the target IP. Thus every server on the list will be sending a response to the target, flooding the target with [SYN, ACK] packets. Seeing as the target hasn't tried to initiate this TCP handshake, the target will respond with a [RST] packet.

The difference between this and, a "regular" SYN flood attack, is that the SYN flood is a protocol, attack abusing a weakness in the TCP protocol, the reflected SYN attack, is a volumetric attack, where the attacking tries to max out the targets bandwidth.

Answer 3

In the syn flood attack, the sender sends to the target many syn packets from IPs which are not on line or never answer to the syn-ack packets sent back from the target to the attacker, in such way the target TCP/IP stack is exhausted due to only two way opened connections that will never fully accomplished: The 3rd way of the tree way handshake will never happen. In the reflection attack, https://en.wikipedia.org/wiki/Reflection_attack, the target responds to its own challenge (the reflection), leaving the attacker with fully authenticated channel connection with no attacker response to the first challenge sent by the target.

Answer 4

Syn Flood Attack is an attack in which the attacker uses a large number of random ip addresses to fill the queues of the SYN so that no other machine can make a connection because the queue is full in the 3 way hand shaking.However Syn Ack Flood Attack,it is an attack based on the bandwidth of the connection. when a server try to send a data to a client it first checks the size of the reciver cognestion window so that if it is less than the recievers size it will send it or it need to have free space that is enough for the data to be send so when this happens the attacker basically let the client acknowledge after the server send the data. that might have a large number than the size of the bandwidth so it actually stop functioning the server will be busy.

Answer 5

On stateful firewall or ids/ips, packets with spoofed IPs and syn/ack set should be automatically discarded if they don't belong to any current session within the server, so i don't really understand why it should be considered a DoS technique. Syn flood, instead, takes advantage of the fact that before closing the half opened connection, new connections are opened by different IPs, so the server must take under control, at the same time, packets with flag syn set and other packets to complete the handshake that will never be sent. The TCP/IP stack is shared between various state of the connections and limited space in memory, so if the "time wait" state to close the half opened connection is too high, resources could be exhausted in a few time, even with no congestioned traffic due to a large number of requests.