ByteOS Network

CAPEC-482:TCP Flood

Attack Pattern ID:482

Version:v3.9

Attack Pattern Name:TCP Flood

Abstraction:Standard

Status:Draft

Details Content History Related Weaknesses Reports

▼Description

An adversary may execute a flooding attack using the TCP protocol with the intent to deny legitimate users access to a service. These attacks exploit the weakness within the TCP protocol where there is some state information for the connection the server needs to maintain. This often involves the use of TCP SYN messages.

▼Relationships

Nature	Type	ID	Name
ChildOf	M	125	Flooding

Nature: ChildOf

Type: Meta

ID: 125

Name: Flooding

▼Prerequisites

This type of an attack requires the ability to generate a large amount of TCP traffic to send to the target port of a functioning server.

▼Mitigations

To mitigate this type of an attack, an organization can monitor incoming packets and look for patterns in the TCP traffic to determine if the network is under an attack. The potential target may implement a rate limit on TCP SYN messages which would provide limited capabilities while under attack.

▼Related Weaknesses

ID	Name
CWE-770	Allocation of Resources Without Limits or Throttling

ID: CWE-770

Name: Allocation of Resources Without Limits or Throttling

▼Taxonomy Mappings

Taxonomy Name	Entry ID	Entry Name
ATTACK	1498.001	Network Denial of Service: Direct Network Flood
ATTACK	1499.001	Endpoint Denial of Service: OS Exhaustion Flood
ATTACK	1499.002	Endpoint Denial of Service: Service Exhaustion Flood

Taxonomy Name: ATTACK

Entry ID: 1498.001

Entry Name: Network Denial of Service: Direct Network Flood

Taxonomy Name: ATTACK

Entry ID: 1499.001

Entry Name: Endpoint Denial of Service: OS Exhaustion Flood

Taxonomy Name: ATTACK

Entry ID: 1499.002

Entry Name: Endpoint Denial of Service: Service Exhaustion Flood