SYN Flooding Attack (Denial of Service)

AI Summary

An AI-generated summary of this video lecture.

This lecture explains the SYN flooding attack as a denial-of-service technique. The presenter uses two diagrams to show how an attacker sends many SYN packets with spoofed source IP addresses to a victim server. The server allocates resources and creates Transmission Control Block (TCB) entries while waiting for the final ACK, but these SYN-ACK replies are lost or never completed. As the half-open connection table fills up, legitimate visitors cannot connect because resources are exhausted.

Chapters

1. 0:00 – 2:00 00:00-02:00

   The slide titled "SYN Flooding Attack(Denial of Service)" introduces the attack with three bullets. The first diagram shows a red Attacker icon sending multiple arrows to a server, while a green Visitor arrow is stopped by a red X labeled "Connections exhausted." The server block lists four rows of "Open port Waiting for ACK:" to illustrate half-open connections. At 25s, the presenter adds a hand-drawn blue arrow over the red arrows to emphasize the flood direction. The bullets explain that attackers fake source IP addresses in datagrams, causing the server to build TCB tables and set timers for connections that will never complete.

2. 2:00 – 3:00 02:00-03:00

   The presentation transitions to a second diagram labeling an "Attacker host" and a "Victim host." Arrows are explicitly labeled "SYN packets with spoofed source IP addresses" moving from attacker to victim, while returning arrows are labeled "SYN-ACK packets with spoofed destination IP addresses." A cylinder graphic is captioned "The memory buffer in the victim host begins filling up," and crossed-out arrows marked "ACK packets" show that the third handshake step never arrives. The final bullet states, "SYN flooding attack belongs to denial of service attack," confirming the classification. The presenter gestures throughout, emphasizing how the server waits for the third leg of handshaking and allocates unused resources until it runs out.

The core concept is that SYN flooding exploits the three-way TCP handshake by initiating many connections but never completing them. The attacker spoofs source IP addresses so that SYN-ACK replies are sent to non-existent hosts, leaving the victim server stuck in a half-open state. Each pending connection consumes memory and table entries (TCBs), eventually exhausting the server's capacity to accept new legitimate connections. The visual progression from a generic attacker-server diagram to a labeled host-to-host sequence reinforces the mechanism: spoofed SYNs in, lost SYN-ACKs out, no ACKs returned, and a filling memory buffer. This is a classic resource-exhaustion denial-of-service attack.