I was curious how a DoS attack would affect a home router. In particular, I'm interested in how a SYN flood would affect a home router.

The reason I'm interested is due to a Cisco document I read. Within the document, it said SYN flood attacks can affect home routers. To me this seems odd because SYN floods must specify the TCP port to attack.

To illustrate a basic SYN flood against a router, I quickly threw together the following image:

enter image description here

Notes about the image: In the image, the attacker is represented by the red A. The attacker is sending SYN messages to the router. The SYN packets have forged IP addresses to mask their origin. The question marks simply denote the random IP addresses which the attacker has set as the fake origin IP addresses. The green lines reflect the router sending SYN-ACK packets to those random IP addresses.

When executing a SYN flood attack, one specifies the port which they will be attacking as well. As far as I know, a router constantly has different ports open which allows it to be asynchronous. So, how would an attacker know which ports to attack? Wouldn't the attacker need to know which ports are open and when?

The only way I can see a SYN flood working against a router would be if the router had a public port constantly open and the SYN flood forced the router to use up all of its RAM.

Can anybody supply some clarification on this matter?

  • 2
    None of the home routers that I've ever owned even accepts packets from the "internet side" unless you have explicitly configured port forwarding (like, to your VPN server) or unless you have established an outgoing connection etc. So the worst thing a SYN flood could do is physically saturate the cable. But of course your mileage may vary. – Damon Nov 15 '14 at 13:56

There are three main ways a SYN flood can work against a home router:

  1. If the router is performing NAT and has a port forwarded to a server, a SYN flood can fill up the router's NAT table, causing it to drop connections.

  2. The SYN flood can act as a simple bandwidth-starvation attack. A typical home router is on an asymmetric connection with limited upstream bandwidth, so a SYN flood targeting a closed port can clog the upstream connection with RST packets sent by the router.

  3. Home router firmware is often rather fragile. Simply throwing SYN packets at it too fast can cause a crash, taking down the connection.


Routers usually has running lightweight Web server that provides access to the configuration web interface. In most cases, it runs on port 80, 8080 or other common one (if isn't changed by the user).

The attacker (standing in the local subnet, if something like "Remote administration" is not enabled on the router, and the WAN port has public IP address) can use port scanner to perform a scan, and then send SYN packets with forged IP on that port. Then, if the router TCP/IP stack does not implement SYN cookies, the result will be filled to it's limit SYN queue and establishment of new connections will be impossible due to the limited memory of embedded devices like SOHO routers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.