Ethical Hacking Essentials Practice Test

What happens in a SYN Flood Attack?

1. The server responds to several malformed packets.

2. A large number of connection requests exhaust the target server's resources.

3. Random UDP packets flood the target network.

4. Custom ICMP packets are used for manipulation.

The correct answer is: A large number of connection requests exhaust the target server's resources.

In a SYN Flood Attack, the primary method involves sending a flood of TCP connection requests (SYN packets) to a target server. The intent is to overwhelm the server's ability to handle incoming requests. When a server receives a SYN packet, it allocates resources to establish a connection and responds with a SYN-ACK packet, waiting for the final ACK packet from the client to complete the three-way handshake. However, in a SYN Flood, the attacker continues to send numerous SYN requests, often from spoofed IP addresses. As a result, the target server will keep these half-open connections in its backlog queue while waiting for confirmations that never arrive. This constant influx of requests can quickly exhaust the server's resources, such as memory and processing power, leading to degraded performance or complete denial of service for legitimate users. The attack takes advantage of the server’s reliance on the three-way handshake process in TCP communication, making it effective against systems that do not have sufficient protections against such tactics.