What is a SYN-ACK Attack?

The SYN-ACK DDoS attack is a type of distributed denial of service (DDoS) attack that exploits the weaknesses within the TCP protocol's connection establishment process. To comprehend its functioning, it is essential to revisit the intricacies of the TCP three-way handshake, a pivotal procedure for establishing a connection between a client and a server:

Initial step: The client sends a request via a SYN packet;

Subsequent step: The server responds to the request with a SYN-ACK packet;

Final step: The client acknowledges with an ACK signal, establishing the connection for data exchange.

In the case of a SYN-ACK attack, attackers send SYN packets mimicking victim IPs to servers providing public TCP-based network services. These servers then respond with SYN-ACK packets destined towards the victim IPs. This flood forces the victims to expend considerable processing resources to decipher the unexpected packet sequence, deviating from the standard SYN, SYN-ACK, ACK TCP three-way handshake mechanism. Consequently, the under attack devices can become overwhelmed by the volume of these packets, rendering their ability to process genuine requests effectively, thereby enabling the attackers to achieve a successful denial-of-service outcome.

‍

‍

Challenges for Internet Providers

In their quest to address this issue, many internet providers have been striving for anti-DDoS solutions. However, most of these providers struggle to detect attacks using the algorithms embedded in their boxes. They have also explored stateful firewalls, but finding a straightforward solution to this complex problem remains challenging. To handle the millions of packets per second effectively, a firewall must possess powerful processing capabilities; implementing such a solution can be extremely costly. Moreover, providers would need to route their upload/download traffic through the firewall service infrastructure, adding another layer of complexity to their network management and significantly escalating costs.

Many of the existing DDoS mitigation solutions in the market fall into the following categories:

1. Implementing SYN Challenges/Authentication to combat SYN attacks and ACK Challenges to mitigate ACK attacks. 
   
   However, these methods can inadvertently disrupt legitimate client users who struggle to navigate through SYN or ACK challenges effectively. Moreover, SYN challenges are commonly employed to defend against SYN flood attacks, although their efficacy against SYN-ACK floods remains unverified.

2. Applying SYN-ACK rate limiting to address SYN-ACK attacks, which can inadvertently impact protected server traffic. 
   
   Setting the limit too low might restrict the number of connections, while setting it too high could potentially enable bypass attacks. Furthermore, rate limiting does not distinguish between legitimate and malicious attacks, potentially resulting in the dropping of legitimate packets.

The core challenge lies in safeguarding both client/server managed objects without compromising the user experience for either party.
‍

‍Nexusguard’s Anti-DDoS Solution

‍Nexusguard, in collaboration with its team of experts, developed a high-capacity method for inspecting SYN-ACK packets tailored to its customers' needs. This approach eliminates the need to reroute uploads from internet providers through Nexusguard's infrastructure. Providers utilizing Nexusguard's Anti-DDoS boxes retain complete control over their upload/download processes at a significantly reduced cost compared to firewall-based structures.

To enhance user experience and bolster security measures, Nexusguard introduced a new real-IP verification module. In essence, the process unfolds as follows:

1. Source IPs are categorized into 3 distinct buckets

• Trusted IP List‍

Drawing from historical user/IP behavior, we compile a list of trusted IPs. These IPs bypass SYN/ACK challenges unless they trigger specific rate limits, ensuring a seamless experience for legitimate visitors.

• Untrusted IP List

IPs in this category undergo SYN/ACK challenges with stringent rate-limit thresholds.

• Normal IP List‍

Comprising IPs not classified as trusted or untrusted, this group is put through SYN/ACK challenges with a more lenient rate-limit configuration.

2. Upon verification as a trustworthy user, IPs are included in the Trusted IP list. In case of suspicious activities, IPs are moved to the Untrusted IP list. Nexusguard refrains from maintaining a permanent Blocked IP list due to the ease with which source IPs/networks can be spoofed, making immediate blocking impractical.

3. Additionally, we implement a rate limit for SYN-ACK flags (involving existing SYN and ACK only) and enhanced verification by considering source IP hosts (/32) and networks (/24) to counter carpet bombing attacks.

‍Proven Use Cases

‍The mitigation of SYN-ACK attacks by Nexusguard’s system has undergone rigorous testing and garnered approval from numerous providers in Brazil. This straightforward reselling system has enabled these providers to boost their profitability by catering to a broader range of internet service providers.

If you seek to safeguard your provider with a comprehensive and scalable system against DDoS attacks, all while avoiding unnecessary complexity in your infrastructure and swiftly generating profits, Nexusguard is the ideal partner for your business. Contact us today for a free consultation.

Nexusguard's innovative real-IP verification module categorizes IPs to safeguard against SYN-ACK attacks while ensuring a seamless user experience.