荣耀彩票代理

IT技术互动交流平台

关于SYN Flood攻击防御的简单介绍

作者:whl  发布日期:2018-12-23 08:33:00
  说到SYN Flood可能很多人都不是很清楚,对于它会造成什么样的危害也一知半解,今天小编就给大家详细介绍一下关于SYN Flood的攻击以及防御的具体操作方法,感兴趣的朋友不妨跟着小编一起继续往下看。

  YI、WEISHENMESyn FloodHUIZAOCHENGWEIHAI

  这要从操作系统的TCP/IP协议栈的实现说起。当开放了一个TCP端口后,该端口就处于Listening状态,不停地监视发到该端口的Syn报文,一旦接收到Client发来的Syn报文,就需要为该请求分配一个TCB(Transmission Control Block),通常一个TCB至少需要280个字节,在某些操作系统中TCB甚至需要1300个字节,并返回一个SYN ACK命令,立即转为SYN-RECEIVED即半开连接状态,而某些操作系统在SOCK的实现上最多可开启512个半开连接(如Linux荣耀彩票代理2.4.20内核)。这种过程如下图所示:

过程如下图所示

  CONGYISHANGGUOCHENGKEYIKANDAO,RUGUOEYIDEXIANGMOUGEFUWUQIDUANKOUFASONGDALIANGDESYNBAO,ZEKEYISHIFUWUQIDAKAIDALIANGDEBANKAILIANJIE,FENPEITCB,CONGERXIAOHAODALIANGDEFUWUQIZIYUAN,TONGSHIYESHIDEZHENGCHANGDELIANJIEQINGQIUWUFABEIXIANGYING。ERGONGJIFAQIFANGDEZIYUANXIAOHAOXIANGBIJIAOKEHULVEBUJI。

  ER、RUHEFANGYUSyn FloodGONGJI

荣耀彩票代理  WOMENXIANLAIKANYIXIASyn FloodYOUNAXIEZHONGLEI,RUXIATUSUOSHI:

Syn Flood有哪些种类

  1. Direct Attack GONGJIFANGSHIYONGGUDINGDEYUANDIZHIFAQIGONGJI,ZHEIZHONGFANGFADUIGONGJIFANGDEXIAOHAOZUIXIAO

  2. Spoofing Attack GONGJIFANGSHIYONGBIANHUADEYUANDIZHIFAQIGONGJI,ZHEIZHONGFANGFAXUYAOGONGJIFANGBUTINGDIXIUGAIYUANDIZHI,SHIJISHANGXIAOHAOYEBUDA

荣耀彩票代理  3. Distributed Direct Attack ZHEIZHONGGONGJIZHUYAOSHISHIYONGJIANGSHIWANGLUOJINXINGGUDINGYUANDIZHIDEGONGJI

  DUIYUDIYIZHONGGONGJIDEFANGFANKEYISHIYONGBIJIAOJIANDANDEFANGFA,JIDUISYNBAOJINXINGJIANSHI,RUGUOFAXIANMOUGEIPFAQILEJIAODUODEGONGJIBAOWEN,ZHIJIEJIANGZHEIGEIPLIERUHEIMINGDANJIKE。DANGRANXIASHUDEFANGFAYEKEYIDUIQIJINXINGFANGFAN。

  DUIYUYUANDIZHIBUTINGBIANHUADEGONGJISHIYONGSHANGSHUFANGFAZEBUXING,SHOUXIANCONGMOUYIGEBEIWEIZHUANGDEIPGUOLAIDESynBAOWENKENENGBUHUITAIDUO,DABUDAOBEIJUJUEDEYUZHI,QICICONGZHEIGEBEIWEIZHUANGDEIP(ZHENSHIDE)DEQINGQIUHUIBEIJUJUEDIAO。YINCIBIXUSHIYONGQITADEFANGFAJINXINGCHULI。

  1.WUXIAOLIANJIEJIANSHISHIFANG

荣耀彩票代理  2. ZHEIZHONGFANGFABUTINGJIANSHIXITONGDEBANKAILIANJIEHEBUHUODONGLIANJIE,DANGDADAOYIDINGYUZHISHICHAICHUZHEIXIELIANJIE,CONGERSHIFANGXITONGZIYUAN。ZHEIZHONGFANGFADUIYUSUOYOUDELIANJIEYISHITONGREN,ERQIEYOUYUSYN FloodZAOCHENGDEBANKAILIANJIESHULIANGHENDA,ZHENGCHANGLIANJIEQINGQIUYEBEIYANMEIZAIQIZHONGBEIZHEIZHONGFANGSHIWUSHIFANGDIAO,YINCIZHEIZHONGFANGFASHUYURUMENJIDESYN FloodFANGFA。

  3.YANHUANTCBFENPEIFANGFA

  4. CONGQIANMIANSYN FloodYUANLIKEYIKANDAO,XIAOHAOFUWUQIZIYUANZHUYAOSHIYINWEIDANGSYNSHUJUBAOWENYIDAODA,XITONGLIJIFENPEITCB,CONGERZHANYONGLEZIYUAN。ERSYN FloodYOUYUHENNANJIANLIQIZHENGCHANGLIANJIE,YINCI,DANGZHENGCHANGLIANJIEJIANLIQILAIHOUZAIFENPEITCBZEKEYIYOUXIAODIJIANQINGFUWUQIZIYUANDEXIAOHAO。CHANGJIANDEFANGFASHISHIYONGSyn CacheHESyn CookieJISHU。

  Syn CacheJISHU:

  ZHEIZHONGJISHUSHIZAISHOUDAOSYNSHUJUBAOWENSHIBUJIYUQUFENPEITCB,ERSHIXIANHUIYINGYIGESYN ACKBAOWEN,BINGZAIYIGEZHUANYONGHASHBIAO(Cache)ZHONGBAOCUNZHEIZHONGBANKAILIANJIEXINXI,ZHIDAOSHOUDAOZHENGQUEDEHUIYINGACKBAOWENZAIFENPEITCB。ZAIFreeBSDXITONGZHONGZHEIZHONGCacheMEIGEBANKAILIANJIEZHIXUSHIYONG160ZIJIE,YUANXIAOYUTCBSUOXUDE736GEZIJIE。ZAIFASONGDESYN ACKZHONGXUYAOSHIYONGYIGEJIFANGDESequence Number,ZHEIGESHUZIBUNENGBEIDUIFANGCAIDAO,FOUZEDUIYUMOUXIESHAOWEIZHINENGYIDIANDESyn FloodGONGJIRUANJIANLAISHUO,TAMENZAIFASONGSynBAOWENHOUHUIFASONGYIGEACKBAOWEN,RUGUOJIFANGDESequence NumberBEIDUIFANGCAICEDAO,ZEHUIBEIQIJIANLIQIZHENZHENGDELIANJIE。YINCIYIBANCAIYONGYIXIEJIAMISUANFASHENGCHENGNANYUYUCEDESequence Number。

  Syn CookieJISHU:

荣耀彩票代理  DUIYUSYNGONGJI,Syn CacheSUIRANBUFENPEITCB,DANSHIWEILEPANDUANHOUXUDUIFANGFALAIDEACKBAOWENZHONGDESequence NumberDEZHENGQUEXING,HAISHIXUYAOSHIYONGYIXIEKONGJIANQUBAOCUNJIFANGSHENGCHENGDESequence NumberDENGXINXI,YEZAOCHENGLEYIXIEZIYUANDELANGFEI。

荣耀彩票代理  Syn CookieJISHUZEWANQUANBUSHIYONGRENHECUNCHUZIYUAN,ZHEIZHONGFANGFABIJIAOQIAOMIAO,TASHIYONGYIZHONGTESHUDESUANFASHENGCHENGSequence Number,ZHEIZHONGSUANFAKAOLVDAOLEDUIFANGDEIP、DUANKOU、JIFANGIP、DUANKOUDEGUDINGXINXI,YIJIDUIFANGWUFAZHIDAOERJIFANGBIJIAOGUDINGDEYIXIEXINXI,RUMSS、SHIJIANDENG,ZAISHOUDAODUIFANGDEACKBAOWENHOU,ZHONGXINJISUANYIBIAN,KANQISHIFOUYUDUIFANGHUIYINGBAOWENZHONGDE(Sequence Number-1)XIANGTONG,CONGERJUEDINGSHIFOUFENPEITCBZIYUAN。

  3. SHIYONGSYN ProxyFANGHUOQIANG

  Syn CacheJISHUHESyn CookieJISHUZONGDELAISHUOSHIYIZHONGZHUJIBAOHUJISHU,XUYAOXITONGDETCP/IPXIEYIZHANDEZHICHI,ERMUQIANBINGFEISUOYOUDECAOZUOXITONGZHICHIZHEIXIEJISHU。YINCIHENDUOFANGHUOQIANGZHONGDOUTIGONGYIZHONGSYNDAILIDEGONGNENG,QIZHUYAOYUANLISHIDUISHITUCHUANYUEDESYNQINGQIUJINXINGYANZHENGHOUCAIFANGXING,XIATUMIAOSHULEZHEIZHONGGUOCHENG:

 使用SYN Proxy防火墙

荣耀彩票代理  CONGSHANGTU(ZUOTU)ZHONGKEYIKANCHU,FANGHUOQIANGZAIQUERENLELIANJIEDEYOUXIAOXINGHOU,CAIXIANGNEIBUDEFUWUQI(Listener)FAQISYNQINGQIU,ZAIYOUTUZHONG,SUOYOUDEWUXIAOLIANJIEJUNWUFADAODANEIBUDEFUWUQI。ERFANGHUOQIANGCAIYONGDEYANZHENGLIANJIEYOUXIAOXINGDEFANGFAZEKEYISHISyn CookieHUOSyn FloodDENGQITAJISHU。

荣耀彩票代理  CAIYONGZHEIZHONGFANGSHIJINXINGFANGFANXUYAOZHUYIDEYIDIANJIUSHIFANGHUOQIANGXUYAODUIZHENGGEYOUXIAOLIANJIEDEGUOCHENGFASHENGDESHUJUBAOJINXINGDAILI,RUXIATUSUOSHI:

数据包进行代理

  YINWEIFANGHUOQIANGDAITIFACHUDESYN ACKBAOZHONGSHIYONGDEXULIEHAOWEIc,ERFUWUQIZHENZHENGDEHUIYINGBAOZHONGXULIEHAOWEIc‘,ZHEIQIZHONGYOUYIGECHAZHI|c-c’|,ZAIMEIGEXIANGGUANSHUJUBAOWENJINGGUOFANGHUOQIANGDESHIHOUJINXINGXULIEHAODEXIUGAI。

  TCP Safe ResetJISHU:

荣耀彩票代理  ZHEIYESHIFANGHUOQIANGSynDAILIDEYIZHONGFANGSHI,QIGONGZUOGUOCHENGRUXIATUSUOSHI:

工作过程如下图所示

  ZHEIZHONGFANGFAZAIYANZHENGLELIANJIEZHIHOULIJIFACHUYIGESafe ResetMINGLINGBAO,CONGERSHIDEClientZHONGXINJINXINGLIANJIE,ZHEISHICHUXIANDESynBAOWENFANGHUOQIANGJIUZHIJIEFANGXING。ZAIZHEIZHONGFANGSHIZHONG,FANGHUOQIANGJIUBUXUYAODUITONGGUOFANGHUOQIANGDESHUJUBAOWENJINXINGXULIEHAODEXIUGAILE。ZHEIXUYAOKEHUDUANDETCPXIEYIZHANZHICHIRFC 793ZHONGDEXIANGGUANYUEDING,TONGSHIYOUYUClientXUYAOLIANGCIWOSHOUGUOCHENG,LIANJIEJIANLIDESHIJIANJIANGYOUSUOYANZHANG。

  SHANGMIANZHEIXIENEIRONGJIUSHIJINTIANXIAOBIANJIDAJIAFENXIANGDEGUANYUSYN FloodHUIDAOZHIDEWEIHAIYIJIRUHEDUIQIJINXINGFANGYUDEJUTICAOZUOFANGFALE。RUGUODAJIADUIYUSYN FloodHAIXIANGLEJIEGENGDUODEHUAHUANYINGCHAKANBENZHANQITAFAWEN,XIAOBIANZHEILIJIUBUZAIYIYIJINXINGJIANGJIELE。

Tag标签:      
  • 专题推荐

About IT165 - 广告服务 - 隐私声明 - 版权申明 - 免责条款 - 网站地图 - 网友投稿 - 联系方式
本站内容来自于互联网,仅供用于网络技术学习,学习中请遵循相关法律法规