| 名称 |
TCP Flood |
|
|
| 摘要 |
An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages. |
| 前置条件 |
This type of an attack requires the ability to generate a large amount of TCP traffic to send to the target port of a functioning server. |
| 解决方案 | To mitigate this type of an attack, an organization can monitor incoming packets and look for patterns in the TCP traffic to determine if the network is under an attack. The potential target may implement a rate limit on TCP SYN messages which would provide limited capabilities while under attack. |
| 关联弱点 |
|
CWE 编号
|
描述
|
| CWE-770 |
Allocation of Resources Without Limits or Throttling |
|
| 关联 CAPEC |
|
CAPEC 编号
|
描述
|
| CAPEC-125 |
An adversary consumes the resources of a target by rapidly engaging in a large number of interactions with the target. This type of attack generally exposes a weakness in rate limiting or flow. When successful this attack prevents legitimate users from accessing the service and can cause the target to crash. This attack differs from resource depletion through leaks or allocations in that the latter attacks do not rely on the volume of requests made to the target but instead focus on manipulation of the target's operations. The key factor in a flooding attack is the number of requests the adversary can make in a given period of time. The greater this number, the more likely an attack is to succeed against a given target. |
|
| 分类体系：ATTACK |
|
条目编号
|
条目名称
|
| 1498.001 |
Network Denial of Service: Direct Network Flood |
| 1499.001 |
Endpoint Denial of Service: OS Exhaustion Flood |
| 1499.002 |
Endpoint Denial of Service: Service Exhaustion Flood |
|