25 Feb 2021 Cyber Linux Networking Open Source

👁8views
A simple DDOS SYN flood Test

CloudScale AI SEO - Article Summary
  • 1.
    What it is
    This article explains how to use hping3 command-line tool to perform SYN flood attacks for testing network security, including specific parameters like packet count, data size, TCP flags, and randomized source addresses.
  • 2.
    Why it matters
    SYN flood attacks are common and can easily knock out applications, so developers and network administrators need to test their defenses against these attacks before they happen in production.
  • 3.
    Key takeaway
    Use hping3 with parameters like --flood and --rand-source to simulate realistic SYN flood attacks and verify your applications can withstand them.
Related Articles

Getting an application knocked out with a simple SYN flood is both embarrassing and avoidable. Its also very easy to create a SYN flood and so its something you should design against. Below is the hping3 command line that I use to test my services against SYN floods. I have used quite a few mods, to make the test a bit more realistic – but you can also distribute this across a few machines to stretch the target host a bit more if you want to.

Parameters:

-c –count Stop after sending (and receiving) count response packets. After the last packet was sent, hping3 wait COUNTREACHED_TIMEOUT seconds target host replies. You are able to tune COUNTREACHED_TIMEOUT editing hping3.h

-d –data data size Set packet body size. Warning, using –data 40 hping3 will not generate 0 byte packets but protocol_header+40 bytes. hping3 will display packet size information as first line output, like this: HPING www.yahoo.com (ppp0 204.71.200.67): NO FLAGS are set, 40 headers + 40 data bytes

-S –syn Set SYN tcp flag

-w –win Set TCP window size. Default is 64.

-p –destport [+][+]dest port Set destination port, default is 0. If ‘+’ character precedes dest port number (i.e. +1024) destination port will be increased for each reply received. If double ‘+’ precedes dest port number (i.e. ++1024), destination port will be increased for each packet sent. By default destination port can be modified interactively using CTRL+z.

–flood send packets as fast as possible, without waiting for incoming replies. This is faster than the -i u0 option.

–rand-source This option enables the random source mode. hping will send packets with random source address. It is interesting to use this option to stress firewall state tables, and other per-ip basis dynamic tables inside the TCP/IP stacks and firewall software.

⚡ Powered by CloudScale 
apt-get update
apt install hping3
hping3 -c 15000 -d 120 -S -w 64 -p 443 --flood --rand-source <my-ip-to-test>
You Might Also Like