An attacker sends a slow, steady stream of TCP SYN segments carrying forged, unreachable source addresses to a web server, at a few kilobits per second. Which resource is being exhausted?

Answer

The server's table of open connections

Options - A. The server's table of open connections - B. The bandwidth of the link between the organisation and its ISP - C. The server's disk, filled by log records for the failed connections - D. The application's CPU, consumed by expensive database queries Why - A. Correct — this is SYN spoofing. Each forged SYN buys a half-open table entry held for the full retransmission timeout, and a full table refuses every further request, legitimate ones included. Much of the industry calls this same attack a SYN flood; this course reserves that name for the bandwidth attack, and only the resource tells the two apart. - B. This is the flooding answer in this course’s stricter sense, and the give-away is the rate: a few kilobits per second cannot saturate a link, which is exactly why SYN spoofing is worth doing. If you picked it because you have met SYN flood used for the table attack, you have met the loose industry usage — the discriminator examined here is the resource. - C. Logging is a side effect, not the target. A server whose only problem was disk would still accept connections until the disk filled, which takes far longer than the table does. - D. Application-resource exhaustion needs valid, expensive requests that reach the application. These connections never complete the handshake, so no request is ever made. Classify by the resource, not by the packet type. SYN spoofing and SYN flooding send the same segments at wildly different rates because they are aimed at different things.

Stallings & Brown, Computer Security 5e, ch7 §7.1–§7.2