Suppose that the victim's web server infrastructure can process 200,000 TCP connection requests per second. Assume that a single connection request (TCP initial SYN) requires 40 bytes to transmit. The victim's web server maximum bandwidth is 100 Mbps. Can the attacker launch a sufficiently large SYN flood to overwhelm the victim's server?


Assuming that the server is in production and that standard rules of thumb apply about having 30% spare capacity (I'm rounding down to 30Mbps spare capacity) and that the outbound pipe is 2x the inbound pipe (as is normal for web servers), the server is already receiving approximately 35Mbps on its inbound pipe, leaving 65Mbps free.

This is 65,000,000 bps (SI units. Mibits per second instead of Mbps if you meant 100 * 220 bits per second.)

If a SYN packet is 40 bytes, there is capacity for 203,125 per second, which is just more than the 200,000 you said it can handle, ignoring the thousands per second it is already processing for normal traffic.

But it won't actually get that far. The server will send replies to all of those SYN packets and if we assume that the SYN/ACK packets are also 40 bytes, then only 30Mbps of inbound SYN packets (93,750 per second) will be required to fill the outbound pipe of the server (which already has 70Mbps of normal traffic) with response SYN/ACKs. The server will actually send multiple replies for each inbound SYN packet after a short timeout so even less than 30Mbps is necessary. Once the outbound pipe of the server is full, the server is effectively down.

Short answer: Yes.

This looks quite a lot like an exam question. I think you can see from my answer why these sorts of exam questions bear little resemblance to reality.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.