Which attack uses TCP SYN flooding techniques with spoofed IP addresses to perform a DoS attack?

Which attack uses TCP SYN flooding techniques with spoofed IP addresses to perform a DoS attack?

• A. SYN flooding a victim
• B. IP Scanner
• C. Network Scanner
• D. ARP ping scan

Answer: (A)

SYN flooding is a Denial of Service technique that overwhelms a target by sending a flood of TCP SYN packets, often with spoofed source IP addresses. In a normal TCP connection, a client sends SYN, the server replies with SYN-ACK, and the client completes with ACK. But in a SYN flood, the attacker doesn’t complete the handshake. The server allocates resources for each half-open connection, and with many SYNs coming in (especially with forged IPs that never complete), the backlog of half-open connections fills up. Once the server’s queue is exhausted, legitimate connection attempts are dropped, causing service disruption. The spoofed IP addresses part helps the attacker avoid easily tracing or blocking the source, since responses go to forged addresses rather than back to the attacker. This description clearly matches a SYN flooding DoS attack, whereas the other options describe scanning tools used for discovery rather than disrupting service.

SYN flooding is a Denial of Service technique that overwhelms a target by sending a flood of TCP SYN packets, often with spoofed source IP addresses. In a normal TCP connection, a client sends SYN, the server replies with SYN-ACK, and the client completes with ACK. But in a SYN flood, the attacker doesn’t complete the handshake. The server allocates resources for each half-open connection, and with many SYNs coming in (especially with forged IPs that never complete), the backlog of half-open connections fills up. Once the server’s queue is exhausted, legitimate connection attempts are dropped, causing service disruption.

The spoofed IP addresses part helps the attacker avoid easily tracing or blocking the source, since responses go to forged addresses rather than back to the attacker. This description clearly matches a SYN flooding DoS attack, whereas the other options describe scanning tools used for discovery rather than disrupting service.