Dos attack principle and defense method

Permissions for TCP/IP protocol DOS (denial-of-service attack)-----denial of Service

The principle of the attack is to use the TCP message header to do the article.

The following is the TCP data segment header format.

Source Port and Destination port: local and destination ports

Sequence number and acknowledgment number: is the ordinal and confirmation numbers, and the confirmation number is the byte number that you want to receive. This is all 32 bits, and in the TCP stream, each byte of data is numbered. Data Offset: Indicates how many 32-bit words the TCP header contains to determine the length of the header, because the optional field length in the header is indeterminate. Reserved: I'm not a man, it's useless now, it's all 0

Next comes 6 1-bit flags, which are the information signs of two computer data exchanges. Receive and send a break depends on these flags to determine the type of information flow. Here are some introductions: URG: (Urgent pointer field significant) emergency pointers. A value of 1 is used to handle the avoidance of a TCP data stream interrupt Ack: (acknowledgment field significant) 1 when the acknowledgment number (acknowledgment numbers) is valid and 0 indicates that the data segment does not contain confirmation information , the confirmation number is ignored.

PSH: (push Function), the data of the push flag, the data segment that is requested at 1 o'clock can be sent directly to the application after the receiver has received it, without having to wait until the buffer is full.

RST: (Reset the connection) is used to reset error connections that occur for some reason and to reject illegal data and requests. Some errors usually occur when the RST bit is received.

SYN: (Synchronize sequence numbers) is used to establish the connection, in the connection request, syn=1,ck=0, the connection response, Syn=1,

Ack=1. That is, SYN and ACK to differentiate connection request and connection accepted.

FIN: (no more data from sender) is used to release the connection, indicating that the sender has no data to send.