One host is launching syn flood attacks against a service, identified by the port number and the IP address of a server. This host uses its own IP address rather than spoofed IP addresses to send SYN packets to the service simultaneously. Assuming the network bandwidth is sufficient, what is the maximal number of distinct TCP connections will the server need to maintain for these attacking packets from this host?

One host is launching syn flood attacks against a service, identified by the port number and the IP address of a server. This host uses its own IP address rather than spoofed IP addresses to send SYN packets to the service simultaneously. Assuming the network bandwidth is sufficient, what is the maximal number of distinct TCP connections will the server need to maintain for these attacking packets from this host?

A+ Guide To It Technical Support

10th Edition

ISBN:9780357108291

Author:ANDREWS, Jean.

Publisher:ANDREWS, Jean.

Chapter8: Network Infrastructure And Troubleshooting

Section: Chapter Questions

Problem 8TC

See similar textbooks

Similar questions

In this problem we investigate whether either UDP or TCP provides a degree of end-point authentication. a. Consider a server that receives a request within a UDP packet and responds to that request within a UDP packet (for example, as done by a DNS server). If a client with IP address X spoofs its address with address Y, where will the server send its response? b. Suppose a server receives a SYN with IP source address Y, and after responding with a SYNACK, receives an ACK with IP source address Y with the correct acknowledgment number. Assuming the server chooses a random initial sequence number and there is no "man-in-the-middle," can the server be certain that the client is indeed at Y (and not at some other address X that is spoofing Y)?
An ISP allocates the 3000:FACE:6/48 block of IPV6 addresses to an enterprise. The entrprise assigns a the subnet id = 2B with an interface id = 2. Using the 3+1+4 address rule, what is the most compressed IPV6 representation of the address? 3000:FACE:6:2:2B/64 3000:FACE:6:0:2:2B/64 3000:FACE:6:2000::2B/64 3000:FACE:6:2:2B/64
A simple CIDR routing table is shown in Figure 1. For each of the destination IP addresses below, indicate which entry in the table it matches. Indicating none if no routing entry can be matched (hint: given an IP packet, the router will check whether there is a routing entry which can be used to route this packet, by checking the destination IP address in the packet with each routing entry: based on the subnet mask of each routing entry, it can extract the network ID and compare it with each routing entry; if there are a few routing entries which can match, the entry with the longest subnet mask wins). Address Mask Output Port 10.19.0.0/16 1 10.19.128/17 2 10.19.192/18 3 10.19.192/19 4 0.0.0.0/1 5 141.219.2.10 10.10.10.10 10.19.86.141 10.19.193.6 10.19.255.86 10.19.192.18
Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below: 1st: client:port1 -> server:port2, SYN 2nd: server:port2 -> client:port1, SYNACK 3rd: client:port1 -> server:port2, ACK When this client is performing scanning attacks, it will generated a large number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed. By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules without considering SYNACK:
Three-way handshake is used by a TCP client and a TCP server to establish a connection, as illustrated below: 1st: client:port1 -> server:port2, SYN 2nd: server:port2 -> client:port1, SYNACK 3rd: client:port1 -> server:port2, ACK When this client is performing scanning attacks, it will generated a large number of failed connections. In each failed connection, the three-way handshake fails to complete. People commonly use SYN together with the absence of its corresponding SYNACK in this same TCP session to identify whether this connection is failed. By investigating the failed connections, an engineer finds that in legitimate/benign cases, if the server does not return SYNACK to the client, the client will not send the ACK packet after SYNACK (e.g., the 3rd packet above). Therefore, this engineer suggests that we can count the failed connections based on the following rules without considering SYNACK: If a client:port1 sends…
Consider a TCP session between Hosts A and B. Assuming that Host A sends a 10byte segment with sequence number 5, what will be the sequence number of the acknowledgment sent from B to A
Using a TCP SYN spoofing attack, the attacker aims to flood the table of TCP connection requests on a system so that it is unable to respond to legitimate connection requests. Consider a server system with a table for 256 connection requests. This system will retry sending the SYN-ACK packet five times when it fails to receive an ACK packet in response, at 30 second intervals, before purging the request from its table. Assume that no additional countermeasures are used against this attack and that the attacker has filled this table with an initial flood of connection requests. a. At what rate must the attacker continue to send TCP connection requests to this system in order to ensure that the table remains full? b. Assuming that the TCP SYN packet is 40 bytes in size (ignoring framing overhead), how much bandwidth does the attacker consume to continue this attack?
The maximum packet size (Maximum Transmission Unit or MTU) of an IP packet including IPv4 header on 100 Mbps Ethernet is usually set at 1500 bytes. A typical IPv4 header consists of 20 bytes, and a UDP header consists of 8 bytes. If we split up a file of 20,000,000 bytes so we can send it as a series of UDP payloads, how many IP packets do we have to send in order to transfer the entire file? Enter an integer number without formatting (no commas). Answer: The MTU for IP packets on 100 Mbps Ethernet is typically set to 1500 bytes. A typical IPv4 header consists of 20 bytes, and a UDP header consists of 8 bytes. If we split up a file of 25,000,000 bytes so we can send it as a series of UDP payloads, how many bytes do we have to send at the network layer in order to transfer the entire file? Enter an integer number (no commas). Answer: You are sending a 27,000,000 byte file using UDP over IP over an Ethernet with MTU 1500 bytes. The Ethernet header is 14 bytes and the frame checksum is 4…
The maximum packet size (Maximum Transmission Unit or MTU) of an IP packet including IPv4 header on 100 Mbps Ethernet is usually set at 1500 bytes. A typical IPv4 header consists of 20 bytes, and a UDP header consists of 8 bytes. If we split up a file of 20,000,000 bytes so we can send it as a series of UDP payloads, how many IP packets do we have to send in order to transfer the entire file? Enter an integer number without formatting (no commas). Answer:
In order to implement a DNS amplification attack, the attacker must trigger the creation of a sufficiently large volume of DNS response packets from the intermediary to exceed the capacity of the link to the target organization. Consider an attack where the DNS response packets are 500 bytes in size (ignoring framing overhead). a. How many of these packets per second must the attacker trigger to flood a target organization using a 30-Mbps link? A 100-Mbps link? Or a 1-Gbps link? b. If the DNS request packet to the intermediary is 60 bytes in size, how much bandwidth does the attacker consume to send the necessary rate of DNS request packets for each of these three cases?
TCP sessions are full-duplex, which means that data can be sent in either direction during the lifetime of the session. Consider a session in which the connection is established, the client sends 100 data segments, all of them are ACKed, and all of the ACKS are received by the sender, then the session is ended by both sides closing the connect. How many segments in total have the SYN bit of the header set to 1? а. 4 O b. 2 с. O d. 1 е. 209
In IEEE 802.11, two-way communication is used to authenticate an open system. In order to authenticate the client, the server must give the station ID (typically the MAC address). Response to the client's previous request is either a successful or failed authentication response from the access point/router. An error may arise if, for example, an AP/router configuration does not include the client's MAC address.In what ways is it advantageous to use this kind of authentication scheme?In what ways does this authentication technique have security vulnerabilities that might be mitigated?