Network Attacks and Defenses

IP-Based Denial-of-Service Attacks  ◾  127

ACK message is never sent to the victim’s server. Because the

source address is spoofed, it is very difficult to determine the

identity of the true attacker when the packet arrives at the

victim’s system.

Attacker host

Victim host

ACK packets

SYN packets with spoofed source IP

addresses

SYN-ACK packets with spoofed

destination IP addresses

e memory buer

in the victim host

begins lling up

5.3.3 Experiment

To determine how to generate and detect the SYN Flood attack,

an experiment is conducted using the Juniper Networks device as

a detection device. This experiment uses the same network archi-

tecture describ