Which attack starts with a SYN while the real connection is not yet established and uses an invalid TCP checksum?

Which attack starts with a SYN while the real connection is not yet established and uses an invalid TCP checksum?

• A. invalid reset attack
• B. Fragmentation
• C. Pre-Connection SYN
• D. Session splicing

Answer: (C)

At the heart of this question is how TCP establishes a connection and how an attacker can tempt a server into creating state without a full, legitimate three-way handshake. The technique described starts the process with a SYN before any real client connection is established, causing the server to allocate resources for a half-open state. The twist here is the use of an invalid TCP checksum in the crafted SYN packet, which can be used to bypass some naive filters or exploit imperfect stack handling, allowing a pre-connection state to be created. This combination is characteristic of a Pre-Connection SYN attack, where the goal is to trigger server-side resources before a real connection is underway or to set up conditions for subsequent exploitation. This differs from fragmentation-based tricks, which rely on splitting packets to confuse reassembly; from invalid reset attacks, which aim to disrupt established connections by sending invalid RSTs; and from session splicing, which involves manipulating an ongoing session rather than initiating a fresh pre-connection.

At the heart of this question is how TCP establishes a connection and how an attacker can tempt a server into creating state without a full, legitimate three-way handshake. The technique described starts the process with a SYN before any real client connection is established, causing the server to allocate resources for a half-open state. The twist here is the use of an invalid TCP checksum in the crafted SYN packet, which can be used to bypass some naive filters or exploit imperfect stack handling, allowing a pre-connection state to be created. This combination is characteristic of a Pre-Connection SYN attack, where the goal is to trigger server-side resources before a real connection is underway or to set up conditions for subsequent exploitation.

This differs from fragmentation-based tricks, which rely on splitting packets to confuse reassembly; from invalid reset attacks, which aim to disrupt established connections by sending invalid RSTs; and from session splicing, which involves manipulating an ongoing session rather than initiating a fresh pre-connection.