SYN flooding and IP spoofing are some classical attacks which can cause denial of service on the host system and the sub network.

A host is said to be under SYN flood attack when the attacker tries to create a huge number of connections and open many ports in the SYN_RECEIVED state of the TCP state diagram on the victim machine's until the backlog queue gets overflowed. After receiving the initial SYN flags, the victim machine puts half open connections into the backlog queues and sends out SYN_ACK responses. If the victim machine does not receive ACK responses, it tries to re-transmit the SYN_ACK packets within time-out period. Here, victim machine maps all pending connections through a finite size data structure in its system memory, and the data structure can be over flown as well.

SYN flooding/IP Spoofing can be easily accomplished using easily available network tools. A system under attack may crash or suffer from resource usage issues..

iPolicy Networks has IDS/IPS signatures which are generalized and specific to many malicious ports/patterns for such attacks, belonging to categories HOST SCAN, NETWORK SCAN, FLOOD and Traffic Anomaly. Few of these are listed below:

• SYN_SCAN - Detects any scan attempt made accross the network or a specific host.
• Syn_Network_Scan - Detects any scan attempt made accross the network.
• Syn_HOST_Scan - Detects any scan attempt made accross a host.
• SYN_network_scan_on_port_25 - Detects network scan attempt on port 25.
• SYN_scan_attack_on_tcpport_135 - Detects SYN flood attempt across a specific host on tcp port 135.
• SYN_scan_attack_on_tcpport_139 - Detects SYN flood attempt across a specific host on tcp port 139.
• SYN_scan_attack_on_tcpport_445 - Detects SYN flood attempt across a specific host on tcp port 445.