Dos attack principle and defense method

Source: Internet
Author: User
Tags ack header reset

Permissions for TCP/IP protocol DOS (denial-of-service attack)-----denial of Service

The principle of the attack is to use the TCP message header to do the article.

The following is the TCP data segment header format.

Source Port and Destination port: local and destination ports

Sequence number and acknowledgment number: is the ordinal and confirmation numbers, and the confirmation number is the byte number that you want to receive. This is all 32 bits, and in the TCP stream, each byte of data is numbered. Data Offset: Indicates how many 32-bit words the TCP header contains to determine the length of the header, because the optional field length in the header is indeterminate. Reserved: I'm not a man, it's useless now, it's all 0

Next comes 6 1-bit flags, which are the information signs of two computer data exchanges. Receive and send a break depends on these flags to determine the type of information flow. Here are some introductions: URG: (Urgent pointer field significant) emergency pointers. A value of 1 is used to handle the avoidance of a TCP data stream interrupt Ack: (acknowledgment field significant) 1 when the acknowledgment number (acknowledgment numbers) is valid and 0 indicates that the data segment does not contain confirmation information , the confirmation number is ignored.

PSH: (push Function), the data of the push flag, the data segment that is requested at 1 o'clock can be sent directly to the application after the receiver has received it, without having to wait until the buffer is full.

RST: (Reset the connection) is used to reset error connections that occur for some reason and to reject illegal data and requests. Some errors usually occur when the RST bit is received.

SYN: (Synchronize sequence numbers) is used to establish the connection, in the connection request, syn=1,ck=0, the connection response, Syn=1,

Ack=1. That is, SYN and ACK to differentiate connection request and connection accepted.

FIN: (no more data from sender) is used to release the connection, indicating that the sender has no data to send.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.