Your network infrastructure is under a SYN flood attack. The attacker has crafted an automated botnet to simultaneously send 's' SYN packets per…

The question assesses the impact of a SYN flood attack based on the server's handling capacity. A system overload occurs when the rate of incoming SYN packets (s) surpasses the server's capacity to manage them (f). The severity of the performance degradation is directly related to the magnitude of the difference, k = s - f.

Given s = 500 packets/sec:

- In scenarios A (f=510) and C (f=505), s is less than f, so the server is not overloaded.

- In scenario B, f = 495, so k = 500 - 495 = 5. The server is overloaded.

- In scenario D, f = 490, so k = 500 - 490 = 10. The server is also overloaded.

Comparing the two overload scenarios (B and D), scenario D has a larger k value (10 vs. 5). According to the problem's formula, where response time increases exponentially with k, a larger k results in a far more significant increase in response time and a more severe system overload. Therefore, scenario D represents the most impactful attack.

A. f=510: The server's handling capacity (f=510) is greater than the attack traffic (s=500). The system is not overloaded and operates normally.

B. f=495: Although the system is overloaded (s > f), the difference k=5 is smaller than in scenario D, leading to a less severe performance degradation.

C. f=S05: The server's capacity (f=505) exceeds the attack volume (s=500), so the condition for overload and increased response time is not met.

---

1. Kaashoek

M. F.

& Zeldovich

N. (2014). 6.858 Computer Systems Security

Fall 2014. Massachusetts Institute of Technology: MIT OpenCourseWare.

Reference: Lecture 15: Network Security

DoS

and Defenses

Section on "TCP SYN flooding".

Content: This material explains that a server has a finite-size backlog queue for pending connections. A SYN flood attack fills this queue with half-open connections. When the rate of incoming malicious SYNs (s) exceeds the server's ability to process them and clear the queue (f)

legitimate connection requests are dropped

leading to denial of service and significantly increased connection times. This directly supports the concept of an overload threshold.

2. Douligeris

C.

& Mitrokotsa

A. (2004). A survey of network-based defense mechanisms countering the DoS and DDoS problems. ACM Computing Surveys

36(4)

366–418. https://doi.org/10.1145/1041680.1041682

Reference: Section 4.1.1

"SYN Flooding Attack".

Content: The paper details how SYN flooding attacks exhaust the victim's resources by filling the Transmission Control Block (TCB) table. Since this table has a finite size (representing the capacity f)

an attack rate (s) exceeding this capacity prevents the server from accepting new

legitimate connections

causing a denial of service. The greater the excess of s over f

the more pronounced the effect.

3. Cisco. (2022). Defining Strategies to Protect Against TCP SYN Denial of Service Attacks.

Reference: Document ID: 13751

Section "SYN Flood Attack Overview".

Content: This official documentation describes how a SYN flood attack consumes server connection resources. It states

"When the connection queue is full

the server rejects all new connection requests... from legitimate hosts." This establishes the principle of a finite capacity (f). Mitigation techniques often involve rate-limiting

which explicitly defines a threshold for SYN packets; traffic exceeding this threshold is dropped

confirming the direct relationship between packet rate and system overload.