Scenario: The Interrupted TCP Handshake
A client attempts to establish a reliable connection to a web server to download a file. The application layer initiates a socket connection, prompting the OS to begin the standard TCP 3-way handshake.
Q:The client sends the initial SYN packet. The server receives it and replies with a SYN-ACK, but a misconfigured router drops the SYN-ACK packet. What happens next from the client's perspective? Reveal â–¾
SYN-SENT state. It will rely on a Retransmission Timeout (RTO). When the timer expires without receiving a SYN-ACK, the client will assume the packet was lost in transit and will retransmit the original SYN packet.Q:While the client is waiting to timeout, what is the server doing? Does the server also retransmit anything? Reveal â–¾
SYN-RECEIVED state. It allocates a slot in its “SYN backlog queue” (a memory structure) to keep track of this half-open connection. Because TCP is a reliable protocol, the server also has a timer for its SYN-ACK. If it doesn’t receive the final ACK from the client, the server will retransmit the SYN-ACK, typically using an exponential backoff strategy (e.g., waiting 1s, then 2s, then 4s) before giving up and dropping the connection.Q:You mentioned the server allocates memory in a 'SYN backlog queue' for this half-open connection. What happens if an attacker maliciously sends millions of SYN packets with spoofed IP addresses and never replies to the SYN-ACKs? Reveal â–¾
Q:If memory exhaustion is the fundamental flaw, how can the operating system be modified to accept connections without allocating any memory for half-open states? Reveal â–¾
The OS can implement SYN Cookies. Instead of storing the connection state in RAM, the server cryptographically encodes the state (including the MSS and a secret key) into the Initial Sequence Number (ISN) of the SYN-ACK packet it sends back to the client. The server then immediately forgets the connection exists.
If the client is legitimate, it will reply with an ACK packet containing an acknowledgment number equal to the ISN + 1. The server intercepts this ACK, subtracts 1, decrypts the hash, verifies the cryptographic signature, and then allocates memory to instantiate the fully open connection.
Q:If SYN Cookies are so effective at preventing memory exhaustion, why aren't they turned on by default for every single TCP connection? Reveal â–¾
Variations & Real-World Impact
- Load Balancers: In modern edge networks, Layer 4 load balancers act as SYN proxies. They absorb the 3-way handshake on behalf of the backend servers, mitigating SYN floods at the network edge before seamlessly splicing the connection to the backend infrastructure.
- IoT & Low-Power Devices: Edge computing devices with extreme RAM constraints often cannot afford a large SYN queue. Implementing optimized, aggressive timeout algorithms is crucial to keep these devices from crashing under basic network scans.
Discussion & Comments