Analyzing of RESPIRE, a novel approach to automatically blocking SYN flooding attacks

Transcription

1 Analyzing of RESPIRE, a novel approach o auomaically blocking SYN flooding aacks ANDRÁS KORN, JUDIT GYIMESI, DR. GÁBOR FEHÉR Budapes Universiy of Technology and Economics, Deparmen of Telecommunicaion and Mediainformaics, HSNLab korn@chardonnay.mah.bme.hu, gj309@hszk.bme.hu, gume@eik.bme.hu Reviewed Key words: aack, couning, flooding, syncookies A few years ago, numerous major web sies were successfully brough down using an aack called SYN flooding. A number of mehods for combaing SYN floods have been proposed, many of which are widely deployed. In his paper, we describe a possible enhancemen o some of hese echniques; a way o auomaically deec, isolae and filer SYN floods while conserving resources on he vicim. 1. Inroducion The TCP SYN aack is made possible because esablishing a TCP connecion involves a so-called hreeway handshake. The clien sars he connecion by sending a packe wih he SYN flag se; i also specifies an Iniial Sequence Number (ISN). The server replies o his wih a packe ha has boh he SYN and he ACK flags se; i conains an acknowledgemen for he ISN of he clien and he ISN of he server. The connecion is finalized when he clien replies o his message wih an ACK packe ha acknowledges he ISN of he server. In order for he server o be able o verify ha he final ACK packe is indeed a reply o he SYN ACK, i has o compare he acknowledged sequence number wih he ISN i gave he clien; hus, i is necessary o esablish a sae when he SYN ACK packe is sen and o mainain i for some ime: eiher unil he final ACK arrives, or unil i imes ou. The aacker hus merely needs o send copious amouns of SYN packes (perhaps using spoofed source addresses). He or she ignores he SYNACK packes of he vicim and never finalizes he connecion. Afer a while, he finie connecion backlog of he vicim will be full and no furher TCP connecions o he aacked por will be possible. 2. Exising soluions Some vendors (e.g. Cisco) offer rouers ha claim o offer proecion agains SYN floods. Some of hese proxy he TCP handshake: hey only send SYN packes o he proeced server if hey already received he final ACK. For he connecion o work, he sequence numbers mus be mangled on each subsequen packe of he session (because he rouer had o choose an iniial sequence number for he connecion, and he ISN of he server is bound o be differen). These rouers ypically also have shorer imeous on half-open connecions and hus are indeed less vulnerable o SYN floods. I is imporan o noe however ha hese approaches don solve he acual problem, hey merely increase he cos of a successful aack. I is sill necessary o allocae finie resources (memory) for each connecion. The only difference is ha he aacker has o deplee he memory of he rouer, no he server. Anoher suggesed soluion was o randomly drop SYN packes using a RED scheme [6]. Like shorer imeous, RED also only makes he aack more expensive, bu no impossible. There are very general and hus somewha heavyweigh ways of dealing wih flooding and congesion in general; one of hese is described in [1]. An ingenious and widely deployed defense agains SYN floods are TCP syncookies [3]. Syncookies work by sending a carefully crafed, crypographically srong ISN back o he clien in he SYN ACK packe, so ha he ACKed sequence number in he final ACK packe is enough o validae he connecion. No sae is esablished and no memory used unil he final ACK arrives. I is unfeasible for he clien o guess a valid ACK sequence number and hereby spoof a connecion wihou receiving a SYN ACK packe from he server firs. Deecing SYN floods is a differen problem. One of he proposed soluions is described in [4] while a saeless, dumb device does have is meris, he problem wih his paricular approach is ha i can only help filer he flood if he device is locaed near he aacker. This means i would have o be deployed a every ISP worldwide in order o be useful. Failing ha, he device can only deec ha a flood is in progress bu can ell us who he perperaor is. 3. Problems wih syncookies However, using syncookies has drawbacks. Firs of all, a connecion esablished using syncookies canno use large windows and can only use a fixed se of Maximum Segmen Size (MSS) values. Second, syncookies ake 44 VOLUME LX. 2005/6

2 Analyzing of RESPIRE ime o compue: Bernsein suggess using he Rijndael algorihm o generae he ISN. Third, hey magnify he effec of he SYN flood by responding wih a flood of SYN ACK packes possibly o unwiing hird paries, if he flood uses forged source addresses. Thus, syncookies can acually make he siuaion worse by allowing bounce flooding. Therefore, even hough syncookies ensure coninued operaion of a service even when under aack, i sill makes sense o use a packe filer o preven he offending SYN packes from reaching he server a all. The approach presened in his paper is complemenary o syncookies. The cookies can ensure ha he service remains available while he RESPIRE (Resource Efficien Synflood Proecion for Inerne Rouers and End-sysems) mechanism reacs o he flood and blocks i; however, as shown below, reacion imes are so shor ha syncookies are no sricly required. 4. How RESPIRE works In conras, our approach requires no addiional daa-gahering equipmen o be deployed. Raher, i makes use of he daa he vicim iself mus collec anyway in order o be able o provide TCP service. The vicim has a plehora of useful informaion we can use o deermine wheher we are under a SYN flooding aack; for example, we probably are if any of he following condiions are me: he number of incoming SYNs per second exceeds a hreshold; a TCP backlog queue ges filled, so we have o sar sending syncookies; he number of half-open connecions exceeds a hreshold; here is a disproporional difference beween he number of SYN ACK packes sen ou and ACK packes received. RESPIRE as described here relies primarily on he las heurisic, bu using a combinaion of all of he above is possible wih minimal modificaions. Noe ha i would be possible o compare he number of arriving SYN packes o he number of inbound connecion-finalizing ACK packes. However, in order o idenify ACK packes ha are indeed he las packe of a handshake, we need o rack all TCP connecions anyway, which involves analyzing he SYNACK packe and recording is ISN. Based on his informaion, we could reconsruc he SYN anyway, so processing he SYN packes separaely seems redundan. However, in order for us o be able o rely on couning oubound SYNACK packes, he vicim needs o be able o respond o a sufficien number of SYN flood packes wih SYNACKs. Syncookies guaranee his abiliy, bu if hey can be used for some reason, we mus choose a backlog size ha allows enough SYNACK packes o be sen for RESPIRE o idenify he aackers before he backlog fills up. If his canno be done, we can sill coun inbound SYN packes insead of oubound SYNACKs, bu sill need o process oubound SYNACK packes as well because we need heir ISN. So, o sum i up: i makes sense o coun inbound SYNs insead of oubound SYNACKs if he proeced server can use neiher syncookies nor a sufficienly large backlog queue. When we are under a SYN aack, he bes we can do is o ignore he SYN packes of he aacker. The simples way o accomplish his is o se up firewall rules ha block SYN sen by he aacker; his means ha our mos imporan objecive is idenifying he address(es) he aacker uses. We could only do beer han his by pushing he filering owards he aacker along he nework roue his packes raverse owards us using pushback [5] or a similar mechanism. Glossary A.B.C.D/E This is a shorhand noaion for an IP subne where he firs E of 32 address bis idenify he nework, wih he remaining bis idenifying a node wihin ha nework. For example, he Budapes Universiy of Technology and Economics uses he /16 nework. E is commonly referred o as he size of he nework. The smaller E is, he more nodes he nework conains. ACK One of he flags used in TCP. Indicaes ha he packe conains an acknowledgemen of previously received daa. cookie Used o denoe crypographically generaed daa ha is used in auhenicaion. DoS Abbreviaion of Denial of Service. DoS aacks ry o disable or saboage a service. SYN One of he flags used in TCP. If se, he packe is referred o as a SYN packe. The TCP handshake sars wih he clien sending a SYN packe. SYNACK The second packe of he hree-way TCP handshake is commonly called a SYNACK packe. I has boh he SYN and he ACK flags se. por Awo-bye endpoin idenifier ha is used by TCP and UDP o disinguish beween nework flows relaed o a single IP address. RED Random Early Drop. A congesion conrol mechanism ha avoids congesion by dropping some packes before he nework becomes congesed. spoofing Forgery (of he source address of a packe). sequence no. Every daa uni sen using TCP has a sequence number: basically he number of byes ransmied so far plus a random offse deermined a connecion seup. The random offse makes connecion forgery more difficul. VOLUME LX. 2005/6 45

3 HÍRADÁSTECHNIKA Hisorically, i used o be possible o forge jus abou any source address on a packe, so isolaing he sources would no have been possible. By now, however, mos neworks have reverse pah filers or are using oher mechanisms o filer packes ha are obvious fakes; herefore, an aacker can ypically only forge addresses wihin one (or a handful of) class C nework(s). We noe ha RESPIRE fails if he aacker can spoof any source address; in fac, i can exacerbae he siuaion by blocking legiimae cliens in an aemp o block he aacker. Combining RESPIRE wih spoof deecors like hop-coun filering [2] can significanly reduce his risk. 5. Anaomy of a SYN Flood The ypical aack scenario oday is ha he aacker has access o a number of compuers compromised previously and now under his conrol commonly referred o as drones in several subnes around he world, and insrucs all of hem o launch an aack in concer, effecively mouning a disribued denial of service (DDoS) aack. To make filering he packes more difficul, he drones use spoofed addresses, bu every address is wihin he same neblock as he real address of he drone; oherwise, he edge rouer of he neblock would discard he packes. Noe ha if he magniude of he SYN flood is sufficien o flood he enire downlink of he vicim, he aack is no longer a SYN aack bu a generic bandwidh depleion aack ha happens o use SYN packes; i is no our goal o deal wih his scenario here. Idenifying he aacker As menioned earlier, we assume ha during a SYN flood, he raio of he number of ougoing SYN ACK packes o he number of incoming handshake-finishing ACK packes is going o be much larger han one. Noe ha mos SYN ACK packes ha go unacknowledged are sen o he aacker; hus, we can idenify he aacker by finding he subne wih he mos ougoing SYN ACKs per incoming ACKs. A naive way of doing his would be o coun he SYN ACK and ACK packes going o and coming from each class C subne in a large able wih 224 (16.7 million) enries. I is easy o see ha his would be grossly inefficien; mos of he couners would be zero, and mos of hose ha are posiive would only indicae benign behaviour. Finding he aacker would require looking a every enry in he able. 6. RESPIRE in deail MULTOPS [7], he algorihm RESPIRE is loosely based on, addresses his problem by soring he couners in an efficien, dynamically expandable hierarchical daa srucure ha explois he hierarchical naure of IP space: a 256-ary ree is consruced o hold he couners. The roo of he ree conains wo couners, iniialized o zero, and 256 poiners, iniialized o NULL. One of he couners, Synack_Ou, couns he SYN ACK packes leaving he sysem. The oher couner, Ack_In, couns he valid ACK packes (ones ha finish TCP handshakes) enering he sysem. Afer a leas Synack_Min SYN ACK packes have been sen, he couners are consuled afer each furher Synack_Num SYN ACK packes are sen ou. The ree srucure makes his a relaively cheap operaion o carry ou. Because he number of ree s is a mos four, four divisions and comparisons and eigh incremens mus be carried ou per SYN ACK packe. For his reason, we recommend seing Synack_Num o one. Sies wih very large amouns of raffic can reduce he overhead by increasing Synack_Num a a small cos in flood deecion speed and accuracy. Insead of deerminisic sampling, sochasic mehods can be used, or Synack_Num can be adjused dynamically based on he amoun of raffic received; however, hese variaions have no impac on he fundamenal operaion of he algorihm. If he raio of Synack_Ou o Ack_In exceeds he value of he parameer R max (a value of 1.5 or more is recommended), hen in he las sampling period, he number of ougoing SYN ACK packes ounumbered he number of incoming ACK packes a leas 1.5 o 1. This should no happen under normal circumsances, so we assume ha we are under aack. If we are under aack, we begin expanding he ree. For each Synack_Num subsequen ougoing SYN ACK or incoming ACK packe, we noe he remoe IP address A.B.C.D. If he roo node poiner A is NULL, we allocae a new node wih he same srucure as he roo node and link i o roo A. All SYN/ACK raffic associaed wih A.0.0.0/8 is from now on couned in boh he roo node and in he couners of roo A. If roo A already exiss, we check if A Synack_Ou Synack_Min[L1] and if roo A Synack_Ou roo A Ack_In > R max If so, A.0.0.0/8 is probably one of he sources of he aack. We zoom in furher by creaing A B if i doesn already exis and so on unil A B C exiss. The Synack_Min parameer can be differen for each ree. Decreasing he limi on he lower s makes aack isolaion faser bu slighly less accurae. To compensae his, i would be possible o increase R max. We plan o invesigae such fine-uning possibiliies in a fuure paper. If A B C exiss, has a leas Synack_Min[L3] SYN ACK packes associaed wih i and he raio of is couners exceeds R max, A.B.C is assumed o be an aacking subne and is blocked, i.e. no furher incoming SYN packes are acceped from A.B.C.0/ VOLUME LX. 2005/6

4 Analyzing of RESPIRE How his blocking is done is beyond he scope of his paper. The possibiliies include, bu are no limied o: Adding he filer o TCP sack of he OS kernel. Using he buil-in packe filering mechanisms of he underlying operaing sysem, if any. Using a mechanism like pushback [5] o reques filering from an upsream rouer. Naurally, hese blocks should be emporary. Afer Block_Timeou minues (15 recommended), hey can be removed. This value should be chosen so ha i is slighly longer han he ypical flood is expeced o be; i is unwise o se i oo high, because having oo many packe filering rules pus a srain on he device ha does he filering. Also, coninuing o block a subne afer he flood is over could resul in blocking legiimae cliens. Once we find and block an aacking subne, we remove is node from he ree; since we blocked i, we won be receiving any furher packes from i anyway, and we subrac is package couners from he couners in is paren nodes. This is done so ha in he paren nodes he packe raios more closely reflec he expeced new disribuion, where packes from he newly blocked subne will no longer ener he sysem. This allows us o more accuraely decide wheher here sill are oher aacking subnes. Once every Prune_Inerval (2 seconds in our simulaion), we check if he ree conains suspicious nodes (wih couner raios in excess of R max ). If so, we zero heir couners. We remove all oher nodes from he ree, excep, obviously, he roo node. Only zeroing suspicious nodes insead of removing hem allows us o more quickly idenify hem as aackers during he nex Prune_Inerval, because we don have o wai for Synack_Min packes o accumulae in heir paren nodes as he lower node already exiss. We zero he couners because we are only ineresed in ongoing flooding aciviy; we do no wan pas suspicious behaviour of a subne o bias our fuure decisions. Unforunaely, his means ha an aacker wih a high number of disinc class C neworks under her conrol can insinuae a slow SYN flood ino he proeced sysem; i.e. she can send less han Synack_Min[L3]/ Prune_Inerval packes per second from each subne, so ha none of hem are idenified as individual flood sources and blocked, bu heir cumulaive effec on he service is derimenal neverheless. In his case, we can classify he nodes as above suspicion, slighly suspicious and definiely suspicious. Nodes are above suspicion if heir couner raio is smaller han an R legi value (1.1 or even 1.05). These nodes we can remove from he ree a Prune_Inerval boundaries. Slighly suspicious nodes have couner raios beween R legi and R max. We zero he couners of hese nodes bu don remove hem ye. A node is definiely suspicious if is couner raio exceeds R max bu i didn ye accumulae Synack_Min packes. We don even erase he couners of such nodes. I is reasonable o expec ha afer a while he nodes associaed wih he aackers will saisfy he crieria of filering. Figure 1. below shows an example RESPIRE ree. The wo columns inside he nodes represen he relaive amouns of SYN ACK and ACK packes respecively (bu no an exac coun). The nodes /8 and /8 sen approximaely as many ACK packes as we sen hem SYN ACKs, so hey are probably benign. The darker nodes on he lef, /8 and /16, are he suspicious ones. Noe ha he roo node is also suspicious ; his is wha ells us ha we are under aack. Figure 1. Example of a RESPIRE ree RESPIRE Memory Usage In order o avoid memory exhausion aacks agains RESPIRE, he oal number of ree nodes mus be limied. One node occupies 2x x64 bis: he wo couners and he 256 poiners, assuming a 64-bi archiecure. This adds up o 2064 byes, or half ha, abou one kilobye on more common 32-bi compuers. The maximum number of nodes ha could be creaed if no limi were enforced is ; hus, he oal amoun of memory used by he ree srucure could increase o up o abou 32.5 gigabyes (half his on 32-bi archiecures), which is impracical o sore and manage. Our simulaion showed ha more han 150 nodes are seldom required even when he aackers command raher large address spaces. If we assume an unrealisic case where 200 differen class C neworks are used o flood he vicim, and hese all reside in differen A blocks, only 600 nodes would have o be allocaed, adding up o slighly more han one megabye in size. Thus, limiing he amoun of nodes o abou 500 seems safe. Wha o do when he limi is reached? If a new node is o be creaed beyond he 500 h, find he leas suspicious node under he roo node and remove i and is children. If he roo node only has one branch, coninue he search on A; obviously he single A node mus have more han one branch, or we could no have 500 nodes in oal. (More sophisicaed mehods could be used o find nodes o delee, bu hey would be more expensive.) VOLUME LX. 2005/6 47

5 HÍRADÁSTECHNIKA 7. RESPIRE reacion ime In his secion we will ry o esimae he reacion ime of he algorihm using mahemaical mehods. Le us firs assume ha we are dealing wih a single aacking class C subne. The calculaions can be generalized o apply o more complicaed cases, excep slow floods, which were discussed earlier. In cases where muliple class C subnes are aacking, we can aggregae he imes needed for each aacking subne o be banned. This will be he wors case, because usually we should be able o ban several subnes in one go. We assume ha he aacking SYN packes arrive wih an inensiy of Ψ packes/sec. The legiimae raffic can be described as a λ parameer Poisson process, since legiimae users are independen. If we assume ha bursiness is minimal, oubound SYNACK and inbound ACK packes likewise resemble Poisson processes, because he ime needed for he compuer o compose a SYNACK packe from an incoming SYN requess is approximaely consan. This way, he Round Trip Time (RTT) does no cause a significan error in his approximaion. Even hough he ACK packes arriving in a ime inerval are no necessarily he replies o he ougoing SYNACK packes of he same inerval, he expeced value of heir number should be almos equal; wih Poisson processes, we can expec a similar number of evens in inervals of he same lengh, regardless of when he inervals sar. Le be he ime he aack begins afer a Prune_ Inerval boundary. Two condiions are esed by he algorihm: and The firs inequaliy is independen of ; hus, if he above assumpions hold, we recognize an aack as soon as Synack_Min is exceeded. The condiion of deecion hus is: Ψ (R max 1) λ l Thus he ime needed for each ree is: = Naurally, deecion akes longer if, while couning, a Prune_Inerval ends, because all couners are zeroed. Forunaely, couning can be resumed a he same ree deph we lef off, because paren nodes are no erased. Using he indicaor funcion I{A} which reurns 1 if condiion A is me and 0 oherwise, boh cases (i.e. crossing an inerval boundary or no) can be wrien in one equaion. The condiion ess wheher he Prune_ Inerval he couning sared in is differen from he one i is supposed o end in. More han one boundary canno be crossed; if he crieria of deecion are me, we deec he flood in eiher one or wo inervals. Simplificaions are possible by recognizing ha if deecion canno be finished in he inerval i sared in, he ime remaining unil he nex boundary is less han. In he nex inerval, we sar couning again, and will ake approximaely seconds o idenify he aacker. The ime spen a a ree can hus be esimaed by: 2 The probabiliy of crossing an inerval boundary is smaller if we se he inerval lengh larger. A compromise mus be found: he desire o only deec on-going aacks requires he inerval o be small, whereas reacion imes are beer if inervals are longer. When he roo node indicaes aack, we sar building he ree. This procedure, along wih he examinaion of he nodes, heir manipulaion, couning ec. do no cause a relevan ime overhead, because packe ransmission imes are ypically several orders of magniude larger. In order o beer esimae he ime spen a each ree, we need o inroduce a parameer a ha indicaes wha fracion of he legiimae raffic originaes from a given subne as we move down he ree. Assuming ha every subne is responsible for an equal porion of he whole raffic would mean ha packes from a specific class A subne make up only abou 1/256 h of all he incoming SYN requess. For a class B subne, he amoun would be 1/256 2, for a class C subne, 1/ Naurally, his will no be rue in pracice. One reason is he disribuion of IP addresses. A he A, a significan porion of he address space is reserved for special purposes. The B and C address spaces are also unequally used, bu he siuaion is no as bad as a A. Thus an approximaion where we use he parameer only a he A, and he lower s are aken o be homogeneous, appears o be accepable. The value of a will vary, bu probably be somewhere beween 16 (local server used mosly wihin a relaively small counry) and 128 (busy global server). Toal reacion ime is he sum of he ime spen a each of he four s. These, if we needn cross any Prune_Inerval boundaries, and are using differen Synack_Min values for each, can be wrien as follows: 48 VOLUME LX. 2005/6

6 Analyzing of RESPIRE If we also wish o accoun for he possibiliy of crossing inerval boundaries, he equaions become more complex: The overall ime needed obviously equals: T = roo + A + B + C Le us consider he case where all legiimae SYN packes come from differen class A subnes han he aacking ones. This gives us he wors case, since deecion ime depends only on he ime needed o collec a leas Synack_Min SYN packes if he aack can be recognized a all. Under hese circumsances we need no assume anyhing abou he disribuion of legiimae raffic among he subnes. We obain: roo = A = B = C = Reacion ime when he algorihm crosses an inerval boundary a each ree can be wrien as: C T = 4 p + Please noe ha alhough reacion ime seems o increase as Prune_Inerval increases, is expeced value acually decreases, as he earlier equaions indicae. The reason is ha when he inerval is longer, he probabiliy of reaching he inerval boundary decreases. Le us now give a rougher, bu more compac approximaion. According o our earlier observaions, he ime needed a each is less, han double he ime ha would be required if no inerval crossing ook place. Toal reacion ime is hus smaller han he ime we ge by assuming ha every needs as much ime as he ha needed he mos ime. λ + Noe ha reacion ime decreases as aack inensiy increases. Reacion is pracically immediae in he case of exreme floods, which cause he mos damage. This corroboraes he resuls of he simulaions; see below. l roo A B C 8. Simulaion resuls In order o analyze he performance of RESPIRE, we also ran a simulaion [8]. For he sake of compleeness, we sum up he resuls in his paper as well. We simulaed a busy SMTP server ha has 62.8 acive connecions and 12.6 new connecions per second on average. 300 simulaed erminals were used o represen legiimae cliens ha randomized heir IP before each connecion. We also planed 8 aackers ino he sysem who flooded he server wih SYN packes. Using hese aackers we modelled a disribued SYN aack. The sae machine implemened in he aackers was differen from he ones in he normal cliens. The aackers use spoofed source addresses ha are uniformly disribued across an enire subne, he base address of which is a random value. The subne mask is chosen randomly beween 16 and 24; aacks ha use enire /16 subnes should be very uncommon in pracice, bu we waned o be generous wih he aackers in order o pu RESPIRE o a harder es. Each aacker performs one SYN aack of random lengh and inensiy. Table 1. (on he nex page) summarizes some of he numerical resuls of he simulaion. Noe ha aacks #5 and #6 appear wice. This happened because hese aacks lased longer han he imeou for he firewall rules (15 minues), so afer he rules expired, hese aacks had o be blocked again. Unfilered packes shows he number of flood packes ha passed RESPIRE by before he filering rules ook effec. The oher columns should be prey self-explanaory. Le us now compare simulaion resuls wih our mahemaical predicions. Aacker #3 has a subne of 4096 addresses (16 adjacen class C neworks). This means we will see 16 suspicious class C nodes in he ree, all descendans of he same class B node. If he aacker chooses he source addresses of his packes uniformly, each of hese nodes will accoun for 1/16 h of he oal flood inensiy, ha is, pps. Down o B we can ac as if we only had a single aacking class C: VOLUME LX. 2005/6 49

7 HÍRADÁSTECHNIKA Aack Firs packe Subne Packe rae Unfilered Reacion No. (s) size (pps) packes ime (s) Table 1. Aacker aciviy A C, we obain: We sugges ha RESPIRE be deployed alongside syncookies. A reference implemenaion for Linux is currenly undergoing bea esing and will soon be released. References The oal prediced ime is hus s which is a good esimae of he measured s. The wo mehods produce comparable resuls. Using he same mehods, we can compue he prediced reacion imes for all aacks: s, s, 0.65 s, s, s, 0.17 s, s. We needn modify our upper esimae if several nonadjacen class C subnes sar aacking a almos he same ime. While his decreases he ime needed for he roo node o become suspicious, i doesn influence he lower s because he aackers reside in differen class A nes. In our esimae, we used he ime spen a he where we spen longes, which cerainly isn he roo node. Thus, he fac ha he roo node needs less ime doesn impac he res of he calculaions. Naurally i can happen ha he disribuion of spoofed source addresses is non-uniform, which causes us o deec one aacking class C subne before anoher. If some class C subnes use a subsanially smaller aack inensiy, oal ime aken can increase. Noe however ha in his case, he more damaging par of he flood has already been filered, so i s accepable o spend slighly more ime blocking he res. 9. Conclusion In his paper, we inroduced RESPIRE, one of several ways o comba SYN-floods. I appears o be a very lighweigh soluion ha neverheless filers SYN floods quickly and reliably. Addiionally, i also reduces he amoun of collaeral damage a SYN flood can cause. Is memory requiremens are very modes, rising above a few kilobyes only when under aack. [1] Raul Mahajan, Seven M. Bellovin, Sally Floyd, John Ioannidis, Vern Paxson, Sco Shenker, Conrolling High Bandwidh Aggregaes in he Nework Compuer Communicaions Review 32:3, July 2002, pp [2] Cheng Jin, Haining Wang, Kang G. Shin, Hop-Coun Filering: An Effecive Defense Agains Spoofed DDoS Traffic, Proc. of he 10h ACM conference on Compuer and communicaion securiy, 2003, pp [3] Daniel J. Bernsein, SYN cookies, hp://cr.yp.o/syncookies.hml, [4] Haining Wang, Danlu Zhang, Kang G. Shin, Deecing SYN Flooding Aacks, Proceedings of IEEE InfoCom, [5] John Ioannidis, Seven M. Bellovin, Implemening Pushback: Rouer-Based Defense Agains DDoS Aacks, Nework and Disribued Sysem Securiy Symposium, February [6] Livio Ricciulli, Parick Lincoln, and Pankaj Kakkar, TCP SYN Flooding Defense, Comm. Neworks and Dis. Sysems Modeling and Simulaion Conference (CNDS 99), [7] Thomer M. Gil, Massimiliano Poleo, MULTOPS: a daa-srucure for bandwidh aack deecion, Proc. of he 10h Usenix Securiy Symposium, Augus [8] Gábor Fehér, András Korn, RESPIRE A novel approach o auomaically blocking SYN flooding aacks, Proceedings of Eunice 2004, pp VOLUME LX. 2005/6