QuoteDisplay MoreOriginally posted by phileditin
These are called SYN attacks, similar to DoS - Denial of service.
More info
The SYN flood attack sends TCP connections requests faster than a machine can process them.
* attacker creates a random source address for each packet
* SYN flag set in each packet is a request to open a new connection to the server from the spoofed IP address
* victim responds to spoofed IP address, then waits for confirmation that never arrives (waits about 3 minutes)
* victim's connection table fills up waiting for replies
* after table fills up, all new connections are ignored
* legitimate users are ignored as well, and cannot access the server
* once attacker stops flooding server, it usually goes back to normal state (SYN floods rarely crash servers)
* newer operating systems manage resources better, making it more difficult to overflow tables, but still are vulnerable
* SYN flood can be used as part of other attacks, such as disabling one side of a connection in TCP hijacking, or by preventing authentication or logging between servers.
SYN flooding is one variant. It is also one of the easiest to defeat. Flooding does not mean SYN floods. It can be ping, malformed packets, port-specific, or even application specific. In all cases (these and more), flooding is referring to exceptionally large counts of whatever is being sent. A SYN flood can be stopped VERY efficiently, from layer 4 on up, or by simple use of Access Control Lists, firewall rules, or an active IDS system.
TLR was not likely a victim of SYN flooding. I'd be more apt to believe it was an inside job, and an attack would make for a good cover up for the embarrassment. since I have seen an attorney worth tens of millions with his login and password known by 10 ppl (2 of which were disgruntled former IT staff), I can authoritatively say that many places that use strong security to the outside, are soft and juicy vulnerable targets for inside attacks. If you have firewall, server and network security, but 4 year old passwords, you have NO security.