International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3412

TCP Syn Flood Attack Detection And
Prevention
D.Deepthi Rani
#1
,T.V.Sai Krishna
*2
,G.Dayanandam
#3
,Dr.T.V.Rao
*4

#1
M.Tech Student,Dept.of CSE,QISCET,Ongole,INDIA
*2
Associate Professor, Dept.of.CSE, QISCET, Ongole, INDIA
#3
Professor,Dept.of.CSE,QISIT,Ongole,INDIA
*4
Professor, Dept.of.CSE,KLU,Guntur,INDIA

Abstract: Denial-of-Service (DoS) is a network security problem
that poses a serious challenge to trustworthiness of services
deployed on the servers. The aim of DoS attacks is to make services
unavailable to legitimate users by flooding the victim with
legitimate-like requests and current network architectures allow
easy-to-launch, hard-to-stop DoS attacks. Nowadays every one
relies on online transactions. These transactions involve one of the
many types of denial of service attacks is known as TCP SYN Flood
attack. The goal of the attacker is exhausts the victim network of
resources such as bandwidth, computing power,etc.,the victim is
unable to provide services to its legitimate clients and network
performance is greatly deteriorated. Defending against those types
of attacks is not trivial job, mainly due to the use of IP Spoofing
and the destination-based routing of the Internet. This paper
explains about efficient packet filtering technique using firewall to
defend TCP SYN Flood attacks. Firewall scripts are written using
command-line tool IP Tables in Linux to deny the suspicious
traffic.
Keywords: Dos Attacks, Flood Attacks, IP tables

1. INTRODUCTION

Denial of Service(DoS) Attacks denies services to legitimate
clients by flooding of legitimate looking service requests to the
server. Such an attack can take many shapes, ranging from an
attack on the physical IT environment, to the overloading of
network connection capacity, or through exploiting application
weaknesses.
Gligor et al.[8] defined DoS as: a group of otherwise-
authorized users of a specific service is said to deny service to
another group of authorized users if the former group makes the
specified service unavailable to the latter group for a period of
time which exceeds the intended waiting time.
TCP SYN Flood attacks are the major part of the DoS attacks.
According to the survey, nearly 92% of the attacks are DoS
attacks. In these attacks, attackers send a succession of SYN
requests to a target system in an attempt to consume enough
server resources to make the system unresponsive to the
legitimate clients.SYN flooding attacks are performed by the
attacker submitting stream of TCP SYN packets to the target
system, filling its connection request queue, and thus reducing
the target systems ability to respond to legitimate connection
requests. The common TCP timeout for unsuccessful
connections is several tens of seconds, thus an attacker can
easily fill the TCP SYN queue before earlier SYNs timeout.
These attacks require very little computation and bandwidth
commitment from the malicious users. In this attack what
happens, an attacker floods the target computer with unfinished
SYN requests.
DDOS Attacks: A DDoS attack uses many computers to launch
a coordinated DoS attack against one or more targets. Using
client/server technology, the perpetrator is able to multiply the
effectiveness of the DoS significantly by harnessing the
resources of multiple unwitting accomplice computers which
serve as attack platforms.
SYN flooding attack: This attack may be used to prevent service
to a system temporarily to take advantage of a trusted
relationship that exists between that system and another. SYN
flooding[4] is an example of DDoS attack that takes advantage
of the way TCP/IP networks were designed to function. In this
attack, the victim is flooded with half open connections. The
client system begins by sending a SYN message to the server.
The server then acknowledges the SYN message by sending
SYN-ACK message to the client. The client then finishes
establishing the connection by responding with an ACK
message. The connection between the client and the server is
then open, and the service-specific data can be exchanged
between the client and the server.


Figure 1 shows the view of this message flow:
International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3413


Fig1: TCP 3-way handshake
The potential for abuse arises at the point where the server
system has sent an acknowledgment(SYN-ACK) back to client
but has not yest received the ACK message. This is known as
half-open connection. The server has built in its system memory
a data structure describing all pending connections. This data
structure is of finite size, and it it can be made to overflow by
intentionally creating too many half open connections.Creating
half-open connections is easily accomplished with IP spoofing.
The attacking system sends SYN messages to the victim server
system. These appear to be legitimate but in fact reference a
client system that is unable to respond to the SYN-ACK
messages. This means that the final ACK message will never be
sent to the victim server system.

Fig2. SYN Flood Attack[1]
Figure 2 shows the scenario of half open connection. The half-
open connections data structure on the victim server system will
eventually fill. Then the system will be unable to accept any
new incoming connections until the tables is emptied out[4].

2.PROBLEM OVERVIEW

The scope of this report explains the concept of SYN Flood
attack generation and detection by using scapy and wire shark
respectively. By using net stat command and shell scripts using
IP tables to deny the suspicious traffic.
3.SOFTWAREAPPLICATIONS

The following free software applications were used in the
process of configuring the SYN flood attack.
Wireshark: Wireshark[7] is a network protocol analyzer. This
multi platform application comes bundled with a GUI to make
network troubleshooting and analysis easy to work with and
view in real time. It is most often used for its packet sniffing
capabilities that allow users to capture and view packets in real
time across a multitude of network protocols.
JAVA: JAVA is a open-source and freely available software
which is used to run normal client server programme to identify
both attack detection and prevention.
NMAP(Network Mapper)
NMAP[6] is freely available network analysis tool.
NMAP is used to perform port scanning, operating system
detection and host discovery etc..
Scapy: Scapy[5] is a powerful interactive packet manipulation
program. It is able to forge or decode packets of a wide number
of protocols, send them on a wire, capture them, match requests
and replies, and much more. It can easily handle most classical
tasks like scanning, trace routing, probing, unit tests, attacks on
network discovery. It also performs other specific tasks that
other tools cant handle.
IP Tables: IP Tables[2] is a current Linux Firewall mechanism
and a successor of ipfilter and ipchains. The primary purpose is
packet filtering based on header fields, e.g., IP addresses, TCP
and UDP ports, and TCP flags. Originally, the most popular
firewall/NAT package running on Linux was ipchains, but it had
a number of shortcomings. To rectify this, the Netfilter[3]
organization decided to create a new product called IPtables.

4. IMPLEMENTATION STEPS


International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3414


Fig3: Implementation steps




Step1: To establish a segregate network using virtualization.
VMware Workstation is used to establish a segregate network
and two UBUNTU 12.04 LTS and UBUNTU 13.04 operating
systems are installed on it.
Step2: Identify open ports on victim machine by using NMAP
tool. If we run java client-server program on victim machine,
then NMAP identifies the port related to running of client-server
program on victim machine.
Step3: Run the IP table rule on attacker machine such that
victims kernels do not receive RSTs.
Step4: Run Wire shark tool on victims machine in order to
detect and analyze DoS attack.
Step5: Write Shell script using IP tables to block SYN flood
attacks on victims machine.

Fig 4: Flow chart for SYN Flood Prevention using Shell script
(using IP tables)




We can reject packets intended for unknown port


Step6: After blocking traffic using IP tables again capturing and
analyzing of live traffic using wire shark. The above six steps
are performed as per diagram shown in Fig3.

5.EXPERIMENTAL RESULTS:

International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3415



Fig 5: Identify open ports in victim machine using NMAP


Fig 6: Run iptable rule at attacker machine to drop RST requests




Fig 7: Identify Half-open states (SYN-ACK pair)
International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3416




Fig 8: Reject TCP connections after TCP SYN Flood attack




Fig 9: Client-server communication after prevention of TCP
SYN flood attack


Fig 10: TCP flow graph showing after prevention of SYN flood
attack


6. CONCLUSION

As the experiments showed a DoS environment could
not actually have been created given the hardware and software
used. This paper discussed python script for TCP SYN flood
attack generation using scapy tool. We can spoof the IP address
and flood the packets to generate attack by scapy tool. We can
detect TCP SYN flood attack using client-server program and
wire shark tool. The main contribution of this paper is writing
shell script that includes IP tables rules, we can prevent TCP
SYN flood attack along with other mitigation techniques
effectively.

7. REFERENCES

1. SYN Flood Wikipedia Encyclopedia, Available:
http://en.wikipedia.org/wiki/syn_flood
2. http://www.linuxhomenetworking.com/Quick_HOWTO_:Ch14_:_Li
nux_FIrewalls_Using IP tables
3. http:// www.netfilter.org/about.html
International J ournal of Computer Trends and Technology (IJ CTT) volume 4 Issue10 Oct 2013

ISSN: 2231-2803 http://www.ijcttjournal.org Page3417

4. H.Wang,D.Zhang,K.G.Shin, Detecting SYN Flooding attacks, In
proceedings of the IEEE infocom,pages 000-001, New York, June
2002,IEEE
5. http:// www.secdev.org/projects/scapy/doc/usage.html
6. Nmap reference guide, insecure.org[http://insecure.org/nmap/man1]
7. Wireshark, wireshark.org[http://www.wireshark.org]
8. Che-Fn Yu and virgil D.Gligor. A specification and verification
method for preventing denial of service.IEEE Trans.Software
Eng.,16(6):581-592,1990.