0

I understand that SYN flood is effective due to how protocol works, waiting around 75 seconds before closing the connection.

What about ACK flood, what does it happen on the destination side that makes this attack effective (hypothetically) ?

Improve this question

1 Answer 1

Reset to default
0

what does it happen on the destination side that makes this attack effective (hypothetically) ?

A SYN flood is effective since each new SYN marks the beginning of a potential new connection and thus the system will allocate a new state (i.e. memory) and send a SYN+ACK back.

An ACK which does not match an existing connection and its state though will simply be discarded. No new memory need to be allocated for this, no data will be sent back. It still takes some time to process and it consumes bandwith, but that's it. This means an ACK attack is not very effective compared to a SYN attack.

Improve this answer
2
  • To be clear, the question "Why ACK flood is effective" is being met with the answer "Actually, it's not." -- am I reading this right?
    – JamesTheAwesomeDude
    Apr 22, 2021 at 21:36
  • @JamesTheAwesomeDude: My answer is not that it s not as effective as a SYN attack. The impact on the target is fairly small, but of course each packet needs to be processed and this will take some time and resources.
    – Steffen Ullrich
    Apr 23, 2021 at 5:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .