Skip to content

04-01: Exercises

Question

A web server's TCP stack has a SYN backlog queue that can hold 128 half-open connections.

An attacker launches a SYN flood, sending 40 spoofed SYN packets per second. Each half-open connection sits in the backlog for 30 seconds before timing out and being evicted (typical retransmission/timeout behavior when the SYN-ACK is never acknowledged).

  1. At what rate does the backlog fill up, accounting for both new arrivals and timeouts?
  2. How long until the queue is completely full and legitimate SYNs start being dropped?

Solution

Step 1: Understand the queue dynamics

The backlog queue holds half-open connections (those that received a SYN and replied with SYN-ACK, but haven't yet received the final ACK). Each entry leaves the queue in one of two ways:

  • It completes the handshake (not happening here — the attacker never finishes it), or
  • It times out after sitting unanswered for 30 seconds.

So while the attack is running, entries accumulate at the arrival rate and drain at a rate determined by the timeout window.

Step 2: Compute the steady-state number of connections in flight

Since each spoofed SYN stays in the backlog for 30 seconds before expiring, and new ones arrive continuously at 40/second, at any moment the number of not-yet-expired attack connections approaches:

Arrival rate × Timeout duration = 40 connections/sec × 30 sec = 1200 half-open connections "in flight" if the queue had unlimited space

This number (1200) far exceeds the backlog capacity of 128, which tells us the queue will fill up well before any timeouts even start clearing space — i.e., the queue fills from pure arrivals long before the 30-second timeout of the first packet is reached.

Step 3: Time to fill the queue from empty

Since the queue fills faster than entries expire (1200 > 128), we can simply divide capacity by arrival rate for the initial fill:

Time to fill = Queue capacity ÷ Arrival rate = 128 ÷ 40 = 3.2 seconds

At T = 3.2 seconds, all 128 backlog slots are occupied by spoofed half-open connections, none of which have had time to expire yet (the first one won't expire until T = 30 seconds).

Step 4: What happens after the queue is full

From T = 3.2s onward, the backlog stays saturated: the attacker keeps sending new SYNs (each dropped/ignored since there's no room), and the only way a slot frees up is when an existing half-open entry times out 30 seconds after it arrived. Since the attacker sustains 40 SYNs/sec — far more than the ~4.3 slots/sec that free up on average (128 slots ÷ 30 sec ≈ 4.3/sec expiring), the queue remains saturated indefinitely as long as the attack continues.

Legitimate clients attempting to connect after T ≈ 3.2 seconds will find no room in the backlog — their SYNs are silently dropped, and they experience connection timeouts.

Final Answer

  • Fill rate context: the attacker's arrival rate (40/sec) vastly exceeds the natural drain rate from 30-second timeouts (~4.3/sec), so the queue fills almost immediately and stays full.
  • Time to fill the 128-slot backlog: 128 ÷ 40 = 3.2 seconds.
  • After ~3.2 seconds, the backlog is saturated and stays that way for as long as the attack continues, since new spoofed SYNs arrive far faster than old ones expire — legitimate connection attempts are dropped from this point on.