COMMON ATTACK PATTERN ENUMERATION AND CLASSIFICATIONLive MITRE record

CAPEC-482

TCP Flood

An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.

Abstraction

Standard

Typical severity

High

Likelihood of attack

Medium

Understand the attack

What is this attack pattern?

An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.

Requirements

What does the attack require?

Prerequisites

  • This type of an attack requires the ability to generate a large amount of TCP traffic to send to the target port of a functioning server.

Skills required

Not stated in the MITRE record.

Resources required

Not stated in the MITRE record.

Defence

How is it prevented and mitigated?

1
To mitigate this type of an attack, an organization can monitor incoming packets and look for patterns in the TCP traffic to determine if the network is under an attack. The potential target may implement a rate limit on TCP SYN messages which would provide limited capabilities while under attack.