TCP/IP Protocol Exploits — Attacks and How to Safeguard By CyberDudeBivash

Executive summary

TCP/IP is the foundation of networked systems worldwide. Attackers still exploit protocol weaknesses — not just application bugs — to perform DoS/DDoS, hijack sessions, intercept traffic, and poison routing. This CyberDudeBivash report explains the common TCP/IP-level attacks, real-world exploitation techniques, and step-by-step defenses (network, host, and operational) you can deploy now to reduce risk.

TCP/IP stack overview (quick)
Common protocol-level attacks (with examples)
Why protocol attacks are still effective
Detection & hunting (SIEM + network)
Practical safeguards (network, host, application)
Hardening recipes — Linux & Windows examples
IDS/IPS / signature & behavior detections (Snort, Suricata, Zeek)
DDoS & volumetric mitigation (cloud + on-prem)
Routing security: BGP, RPKI & best practices
Incident response checklist for protocol attacks
Testing & red team / validation tips
Roadmap & recommendations
Hashtags, CTAs, and next steps

1 — TCP/IP stack (quick refresher)

Link / Data Link (Ethernet, ARP) — local LAN functions.
Network (IPv4/IPv6, ICMP) — routing & addressing.
Transport (TCP, UDP) — session reliability (TCP) and connectionless (UDP).
Application (HTTP, DNS, SMTP, etc.) — actual services.

Attacks target any layer — but protocol-level exploits are attractive because they can be low-effort and high-impact.

2 — Common protocol-level attacks (explained)

2.1 SYN flood (classic TCP DoS)

Attacker sends many TCP SYNs with spoofed source IPs. Server allocates half-open state (SYN-RCVD) and is overwhelmed.

Impact: Connection table exhaustion, service unavailability.
Hard but effective mitigation: SYN cookies, increased backlog, rate limiting, upstream scrubbing.

2.2 TCP session hijacking / TCP reset attacks

Hijacking: Predict TCP sequence numbers (legacy) or steal session via MITM. Modern TCP stacks randomize seq numbers — but weak networks and misconfigurations still enable attacks.
TCP Reset (RST) injection: Send forged RST packets to tear down sessions (used in censoring or sabotage).

2.3 IP fragmentation attacks (Teardrop, overlapping fragments)

Old kernels failed to handle overlapping fragments leading to crashes. Modern OSs are patched, but fragmentation can still be abused to evade IDS or to kit multistage payloads.
Mitigation: Reassembly checks, drop suspicious fragmentation patterns at edge.

2.4 ICMP attacks (Smurf, Ping of Death)

Smurf: Spoofed ICMP echo with broadcast destinations amplifies traffic.
Ping of Death: Oversized or malformed ICMP can crash old hosts. Mostly historical but reminders to harden ICMP handling.

2.5 ARP spoofing / ARP poisoning (LAN MITM)

Attacker poisons local ARP tables to intercept LAN traffic (MITM), used to harvest credentials or inject traffic.
Mitigation: Static ARP where possible, 802.1X, dynamic ARP inspection on switches.

2.6 DHCP starvation / rogue DHCP

Exhaust DHCP pool to force clients to fallback to attacker DHCP server. Attacker then directs clients to malicious gateways.
Mitigation: DHCP snooping, port security.

2.7 DNS-based protocol attacks

DNS cache poisoning, DNS amplification (reflection) are a type of protocol exploitation with huge amplification factors.
Mitigation: DNSSEC, rate limiting, no open resolvers.

2.8 BGP hijacking & route leaks

Attackers announce IP prefixes they don’t own; traffic is misrouted or intercepted. Used for large-scale interception, spam, or blackholing.
Mitigation: RPKI, BGP TTL security, prefix filters.

2.9 IPv6-specific attacks

Rogue Router Advertisements (Rogue RA), IPv6 header chain abuse, ICMPv6 floods.
Mitigation: RA guard, SLAAC restrictions, firewall rules for IPv6.

2.10 TCP option abuses & middlebox evasion

Manipulating TCP options or fragmentation to evade IDS/IPS. Attackers craft packets that pass middleboxes but are interpreted differently by endpoints.

3 — Why these attacks still work

Legacy devices and IoT with unpatched stacks.
Misconfigured networks (open resolvers, permissive ACLs).
Amplification/reflection for low-cost high-impact attacks.
Supply chain: compromised third-party devices running older firmware.
Blind spots in monitoring — many orgs inspect traffic only at application level.

4 — Detection & threat hunting (SOC playbook)

Network indicators

Sudden spike in SYN packets with low ACK rate (SYN flood).
Large volume of small UDP packets to many destinations (reflection).
Numerous RSTs torn by single source (RST injection).
New prefixes in BGP announcements (route hijack).
ARP table churn and duplicate MAC addresses (ARP spoofing).

Example Zeek (Bro) script (hunt SYN flood)


@load base/protocols/tcp
redef Notice::policy_mode = Notice::LOG;
event tcp_connection_established(c: connection) {
  # Zeek collects connection stats; use for abnormal counts
}
# Use Zeek scripts to count SYN rate per dst

Splunk example (SYN flood)


index=netflow (tcp.flags_syn=1)
| stats count by dest_ip, src_ip, src_port
| where count > 10000

Elastic/Kibana

Visualize SYN vs SYN-ACK ratios; alert when SYN >> SYN-ACK.

5 — Practical safeguards (network, host, app)

Network-level (edge + core)

Ingress/Egress filtering (BCP38) — prevent IP spoofing at your edge.
SYN cookies & backlog tuning — on servers and load balancers.
Rate limiting & connection throttles — per IP and per network.
DDoS scrubbing services / on-prem mitigation appliances (cloud scrubbing, Anycast).
Disable unused ICMP types and restrict ICMP to trusted networks.
ARP/DHCP protections: dynamic ARP inspection (Cisco), DHCP snooping.
BGP hardening: prefix filters, RPKI validation, IRR-based filters.

Host-level

Kernel hardening: reject suspicious fragments, tune net.ipv4/* sysctls.
Use HSTS/TCP Timestamps and modern TCP stacks.
Disable source routing.
Use host-based firewalls (iptables/nftables/windows firewall) and eBPF to block unusual patterns.

Application-level

TLS everywhere (prevent content snooping even if MITM occurs).
Use tokenization and short-lived session tokens to limit the window for session hijack.
Implement secure session management (HTTPOnly cookies, SameSite, secure flags).

6 — Hardening recipes (Linux & Windows)

Linux (sysctl tuning)

Add to /etc/sysctl.conf:


# Basic TCP hardening
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.icmp_ignore_bogus_error_responses = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

Then sysctl -p.

nftables example (basic SYN rate limit)


nft add table ip filter
nft add chain ip filter input { type filter hook input priority 0 \; policy accept \; }
nft add rule ip filter input tcp flags syn tcp option maxseg size set rt size 4096 counter limit rate 25/second burst 50 packets drop

Windows (registry / netsh)

Enable SYN attack protections via Windows firewall and tune TCP parameters with netsh int tcp set global and use Windows Defender Firewall with Advanced Security for rate limiting where possible.

7 — IDS/IPS & signature detection

Snort/Suricata example rule (SYN flood heuristic)


alert tcp any any -> $HOME_NET any (flags: S; detection_filter: track by_dst, count 50, seconds 2; msg:"Potential SYN flood"; sid:9000001; rev:1;)

Zeek detection ideas

Detect high SYN / low SYN-ACK ratio per dst.
Detect repeated RSTs from diverse sources to single session (RST injection pattern).

8 — DDoS & volumetric mitigation

Cloud scrubbing / CDN + WAF: Offload public endpoints to providers (Cloudflare, Akamai, AWS Shield).
Anycast to distribute traffic.
Rate-limiting + challenge pages for application layer attacks.
Upstream coordination (ISPs) to filter at source for massive volumetric floods.
Plan for failover: blackholing vs sinkholing decisions prepared in advance.

9 — Routing security: BGP & RPKI

Adopt RPKI and validate origin AS for routes.
Implement strict prefix filtering on peering links.
Monitor BGP for unexpected origin or prepends; alert on anomalies.
Subscribe to BGP monitoring feeds (e.g., RIPE RIS, BGPStream) and set automated alerts.

10 — Incident response checklist (protocol attacks)

Identify & isolate affected network segments.
Capture pcap for forensic analysis.
Check upstream (ISP) for filtering / scrubbing activation.
Apply emergency ACLs to reduce attack vectors.
Notify stakeholders & activate IR playbook.
Persist logs (flow logs, router logs, IDS logs).
Post-incident: review mitigations, patch devices, adjust thresholds.

11 — Testing & red teaming

Simulate SYN floods in isolated lab (use hping3 with caution) to validate SYN cookie & firewall behavior.
Validate BGP filters in a controlled lab or with Route Origin Validation testers.
Use ARP spoofing tools (ettercap in lab) to test switch-level protections and DAI.
Pen testers should include protocol fuzzing (packets with strange flags/options) to test stack resilience.

12 — Roadmap & recommendations (practical priorities)

Short term (0–30 days):

Enable rp_filter, tcp_syncookies, and basic rate limits.
Identify and block open resolvers and open NTP/chargen services.

Medium (1–3 months):

Implement egress + ingress filters (BCP38) where possible.
Deploy or enable IDS/IPS signatures for protocol anomalies.
Onboard cloud scrubbing services for public-facing assets.

Long term (3–12 months):

Implement RPKI + strict BGP filtering.
Adopt eBPF-based telemetry for deep packet inspection without performance penalty.
Regular tabletop and red-team tests for protocol-layer incidents.

Useful tools & references

hping3, scapy (testing & fuzzing in lab)
Zeek (Bro) for network monitoring
Suricata / Snort for IDS/IPS signatures
BGPStream / RIPE RIS for BGP monitoring
Cloud DDoS Scrubbers (Cloudflare, Akamai, Radware, Arbor)
Netdisco / Nmap for asset discovery

#CyberDudeBivash #TCPIPSecurity #NetworkSecurity #DDoSDefense #BGP #RPKI #IDS #Zeek #Suricata #ZeroTrust #ThreatIntel