Hi I'm a newbie in networking, still confused with the relationship between three-way handshake and Denial of Service attack.
As we know that if the client does not send an ACK to complete the third step of this 3-way handshake, eventually (often after a minute or more) the server will terminate the halfopen connection and reclaim the allocated resources.
so my questions are:
why attackers just do the first step of 3-way handshake? why don't they just complete all three steps of 3-way handshake to be fully connected with the server just like normal users so it is going to take up the resource of the server
The classic textbook: Computer Networking : a top-down approach describes TCP's approach to avoid Dos attacks:
The server creates an initial TCP sequence number that is a complicated function (hash function) of source and destination IP addresses and port numbers of the SYN segment, as well as a secret number only known to the server. if the client does not return an ACK segment, then the original SYN has done no harm at the server, since the server hasn’t yet allocated any resources in response to the original bogus SYN.
But if the original SYN has done no harm at the server, why the hash function is needed to create a 'cookie' for the server to identify the user's SYN segment in the first step of 3-way handshake to see whether it is valid?