Skip to content

Networking

When Can I Drop SYN Packets Safely?

With the rise of volumetric denial-of-service attacks, it matters more than ever to identify unusual and potentially malicious SYN packets — and know when it's safe to drop them.

2 min read
  • tcp
  • firewall
  • dos

IPv4 Packet Bit Sequence (view full size, opens in a new tab)

With the rise of volumetric denial-of-service attacks, it has become more and more important to identify unusual and potentially malicious SYN packets.

When identifying an unusual packet, it's important to understand how we are able to say, "this isn't right" or "this looks good." To determine this, we base these classifications on RFC's, short for request for comments. These documents provide standards which packets must follow.

Throughout this article we will base our decisions on what is normal and what is unusual based on these standards. While a packet breaking the standards does not guarentee that it is malicious, it does indicate a risk which in many cases isn't worth accepting.

SYN packets are identified by the activated 1-bit SYN flag, located at the 110th bit of an IPv4 packet.

Before explaining what flags or characteristics violate the RFC, let's briefly cover which flag combinations are common and should be expected by every network aficionado:

  • SYN
  • SYN/ACK
  • ACK
  • FIN/ACK
  • PSH/FIN/ACK
  • RST
  • RST/ACK

While there may be other combinations which can exist, these are the most common. Today though, we will focus on SYN packets.

First and foremost, let's get the easiest to identify invalid combination out of the way: SYN/FIN. This is wrong because of what each of the flags is meant to be used for. SYN packets are meant to be used for starting TCP connections. When paired with the FIN flag, which is used to teardown a connection. When these flags are set together, the packet cannot accomplish either task.

This combination of flags, as well as many variations such as SYN/FIN/PSH, SYN/FIN/RST, and SYN/FIN/PSH/RST are common in older security scanning applications because IDS did not identify these. Today, these packets are identified by most modern IDS and security tools. For this reason, any of these combinations can be dropped without too much concern.

The second packet flag combination which you can safely eliminate is any packet which has the reserved bits set. These bits are reserved for potential future use, and should not ever be set.

The third type of SYN packet which can be safely dropped are SYN packets which contain data. SYN packets should never include data and should be actively dropped as this can be an evasion tactic for network security systems (Source).

The fourth type of SYN packet, or any packet for that matter, which can and often should be dropped are packets which have a source or destination port of 0. Packets with this set are commonly saying that they have no layer 4 header information and cannot be forwarded up the stack. To my knowledge, the only potential legitimate use for a port 0 packet are certain ICMP packets.

Thanks for sticking it out and hope you enjoyed this post as I taught you what SYN packets can safely be dropped from your network. Leave me your thoughts in the comments below!

Tag