ZyXEL Communications B-5000 - Uživatelská příručka stáhnout pdf (Strana 232)

ZyAIR B-5000 User’s Guide

28-4 Firewall

Teardrop program creates a series of IP fragments with overlapping offset fields. When these

fragments are reassembled at the destination, some systems will crash, hang, or reboot.

2. Weaknesses in the TCP/IP specification leave it open to "SYN Flood" and "LAND" attacks. These

attacks are executed during the handshake that initiates a communication session between two

applications.

Figure 28-2 Three-Way Handshake

Under normal circumstances, the application that initiates a session sends a SYN (synchronize) packet to the

receiving server. The receiver sends back an ACK (acknowledgment) packet and its own SYN, and then the

initiator responds with an ACK (acknowledgment). After this handshake, a connection is established.

2-a SYN Attack floods a targeted system with a series of SYN packets. Each packet causes the

targeted system to issue a SYN-ACK response. While the targeted system waits for the ACK that

follows the SYN-ACK, it queues up all outstanding SYN-ACK responses on what is known as a

backlog queue. SYN-ACKs are moved off the queue only when an ACK comes back or when an

internal timer (which is set at relatively long intervals) terminates the three-way handshake. Once

the queue is full, the system will ignore all incoming SYN requests, making the system unavailable

for legitimate users.

1 2 ... 227 228 229 230 231 232 233 234 235 236 237 ... 286 287

Žádné komentáře

ZyXEL Communications B-5000 - Uživatelská příručka Strana 232