Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

A network administrator notices that an internal web server has suddenly stopped accepting new client connections. Analysis of packet captures shows thousands of incoming TCP packets with the SYN flag set coming from randomized source IP addresses, but none of these clients complete the three-way handshake with an ACK response. Which type of network attack is occurring?

  1. SYN flood attackAnswer
  2. B
    ARP poisoning attack
  3. C
    DNS poisoning attack
  4. D
    Port scanning attack

Answer

SYN flood attack
The correct answer is SYN flood attack. In a TCP SYN flood, an attacker sends repeated SYN requests to open ports on a server without completing the three-way handshake. The server keeps connection state queues open for ACK responses that never arrive, eventually exhausting server resources and causing a denial of service to legitimate users.

Step-by-Step Solution

1
Analyze the network symptoms provided in the incident logs.
Identified high volumes of TCP SYN packets that leave connections half-open without sending final ACK responses.
This behavior directly targets the TCP connection queue capability of the destination server.
2
Match the observed packet behavior to standard network attack definitions.
Exhaustion of TCP handshake state resources by incomplete SYN requests is the defining characteristic of a TCP SYN flood Denial-of-Service attack.
Legitimate connections are denied because all available connection slots remain occupied by half-open requests.

Key Concept

TCP SYN Flood Attack
Estimated Time:45s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic