So lets say someone sends a lot of SYN requests to a server by spoofing IP, before receiving the ack from the client, does the server reserves the connection's Window size in its memory? if not, then what are the resources that are being wasted here, if the client sends a lot of SYN requests without sending the ACK? what resources does the server reserves when getting an ACK from a Client?

Also i have seen that when a router gets flooded with TCP SYN requests(for port 22/SSH for example) the CPU usage goes very high, but i don't understand why, isn't the response to a SYN request packet pretty straight forward? aren't routers and servers built in a way that they can respond to SYN request packets pretty fast with low cpu usage considering SYN request packets are very common?

closed as off-topic by user36472, Zac67, Ron Maupin Aug 9 '18 at 13:37

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Community, Zac67, Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, what your host OS does is off-topic here. You could try to ask this question on the SE site dealing with your OS. – Ron Maupin Aug 9 '18 at 13:37
  • @RonMaupin What do you mean by SE site? for example where should i ask this for Microsoft servers or linux servers? – John P Aug 10 '18 at 15:26
  • 1
    For servers in a business network, there is Server Fault, there are also sites like Unix & Linux, Ask Ubuntu, Ask Different, Super User, etc. Each of the SE (Stack Exchange) sites has a What topics can I ask about here? page that you are supposed to read before posting a question. – Ron Maupin Aug 10 '18 at 15:30

Whenever the server receives SYN request, it will open communication channel, and depending on the operating system and application using that port, additional resources will be allocated. Usually a SYN timeout is set on the server after which the resources will be released. For Denial of Service to work, the sender must send large amount of SYN packets within that timeout period to overwhelm the server.

Same applies to routers, the router has to reserve Socket for SSH session until it times out. So, although it will reply back with ACK+SYN to the original SYN packet, the expectation is that it will receive ACK for its own SYN for the same Handshake to complete the communication channel. Again, if the sender is sending large amount of SYN packets, that it will overwhelm the router.

  • But does the receiver reserves the entire Window size after receiving SYN or it waits for the ack to come then it reserves it? (talking about most of the modern servers) – John P Aug 9 '18 at 8:47
  • The SYN packet will have the Window size of Sender, that is the amount that Sender can receive before acknowledging. The receiver will send its own Window size in the SYN packet that it will send back along with ACK of the senders's SYN packet. The resources will be reserved based on Receiver's Window Size, like buffer along with connection entries and so on. – Abu Zaid Aug 9 '18 at 9:52
  • but does the receiver reserves the buffer when it gets a SYN request or after it receives the ACK in final step of handshake?? – John P Aug 9 '18 at 9:58
  • It will not reserve anything when it receives the SYN Packet. The reservation will start after it processes SYN and send out SYN/ACK with window Size. Now, how it actually handles the buffers in memory, I do not know, you may have to look at the actual TCP/IP Stack code to determine how the memory is being handled. – Abu Zaid Aug 9 '18 at 11:43

A host is free to do as it wishes as regards its internal resource management.

It seems reasonable a host would allocate resources (more than just the TCB) before sending the SYN-ACK, otherwise how does it know it will be able to honour the incoming connection? It also seems reasonable to delay as late as possible, to minimise the impact of "frivolous" incoming requests.

Your question is best regarded as an empirical question about the various manufacturers' software. My suggestion would be to try it on whatever equipment you can get onto the bench. Try to compare SSH vs telnet into the router -- it might well be crypto initialisation using the CPU. Also look at memory allocation, not just CPU usage.

Finally I note from RFC 793 sect 3.4:

these examples do not show connection synchronization using data-carrying segments, this is perfectly legitimate, so long as the receiving TCP doesn't deliver the data to the user until it is clear the data is valid (i.e., the data must be buffered at the receiver until the connection reaches the ESTABLISHED state)

Not the answer you're looking for? Browse other questions tagged or ask your own question.