ALL TCP Flags Flood (Sometimes referred to as Xmas Flood)
An ALL TCP FLAGS flood is a DDoS attack designed to disrupt network activity by saturating bandwidth and resources on stateful devices in its path.
By continuously sending ALL TCP Flags packets towards a target, stateful defenses can go down (In some cases into a fail open mode). This flood could also be used as a smoke screen for more advanced attacks. This is true for other out of state floods too.
ALL TCP Flags Packets are considered an illegal packet by the Original TCP RFC. While it left room for customized behavior it is virtually unused today. Thus different systems can react differently to these packets and may cause unexpected issues and behavior.
Below an analysis of an ALL TCP Flags flood is shown. The following images depict a high rate of ALL TCP Flags packets being sent from a single source IP towards a single destination IP.
In Image 1 below, you can see the flood of ALL TCP Flags packets coming from a single source. Notice the rate at which the packets are sent.
“Image 1 – example of single ALL TCP Flags packet being sent to port 80”
As seen in Image 2. The capture analyzed is 9 seconds long and the average number of packets per second are at 58, with a rate of around 3Kbps. Attack rates could be much higher.
“Image 2 – ALL TCP Flags Flood stats”
A typical ALL TCP Flags flood running against an unsuspecting host will look similar to the above analysis. Generally what is seen is a high rate of ALL TCP Flags packets (not preceded by a TCP handshake) and a slightly lesser rate of RST packets coming from the targeted server.
Analysis of an ALL TCP Flags flood in Wireshark – Filters
Filter ALL TCP Flags packets – “tcp.flags == 0X03f”.
Goto Statistics -> Summary on the menu bar to understand the rate you are looking at.
Download Example PCAP of ALL TCP Flags Flood
*Note: IP’s have been randomized to ensure privacy.
Download ALL TCP Flags Flood PCAP