{"id":1300,"date":"2021-03-02T03:05:00","date_gmt":"2021-03-02T02:05:00","guid":{"rendered":"https:\/\/mikadmin.fr\/blog\/?p=1300"},"modified":"2021-09-19T01:33:00","modified_gmt":"2021-09-18T23:33:00","slug":"syn-flood-attack-ddos","status":"publish","type":"post","link":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/","title":{"rendered":"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?"},"content":{"rendered":"<span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 3<\/span> <span class=\"rt-label rt-postfix\">min read<\/span><\/span><p>Views: 591<\/p>\n<div style=\"height:24px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Une attaque <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN flood<\/span><\/strong> (attaque semi-ouverte) est un type d\u2019attaque par&nbsp;<a href=\"https:\/\/www.cloudflare.com\/fr-fr\/learning\/ddos\/what-is-a-ddos-attack\" target=\"_blank\" rel=\"noreferrer noopener\">d\u00e9ni de service (DDoS)<\/a>&nbsp;qui vise \u00e0 rendre un serveur indisponible pour le trafic l\u00e9gitime en consommant toutes les ressources serveur disponibles. <\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-image is-style-default\"><figure class=\"aligncenter is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg\" alt=\"Progression of a SYN flood.\" width=\"473\" height=\"339\"\/><\/figure><\/div>\n\n\n\n<hr class=\"wp-block-separator has-text-color has-background has-vivid-cyan-blue-background-color has-vivid-cyan-blue-color is-style-wide\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h1 class=\"has-text-align-center wp-block-heading\" style=\"font-size:35px\"><strong>Three-way handshake<\/strong><\/h1>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">L&rsquo;attaque <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong> exploite le principe du <strong>three-way handshake<\/strong> du protocole <strong><a href=\"https:\/\/mikadmin.fr\/blog\/activer-lip-forwarding-sous-linux\/\" target=\"_blank\" rel=\"noreferrer noopener\">TCP<\/a><\/strong>.  <\/p>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Lors d&rsquo;une connexion classique entre un <strong>client<\/strong> et un <strong>serveur<\/strong> il y a 3 \u00e9tapes :<\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">\u2705 Le client envoie un paquet <strong>SYN<\/strong>.<\/p>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">\u2705 Le serveur r\u00e9pond ensuite avec un paquet <strong>SYN-ACK<\/strong> accusant la r\u00e9ception.<\/p>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">\u2705 Le client envoie un paquet <strong>ACK<\/strong> et la connexion <strong>TCP<\/strong> est donc \u00e9tablie.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/docs.aws.amazon.com\/whitepapers\/latest\/aws-best-practices-ddos-resiliency\/images\/image5.png\" alt=\"\"\/><\/figure><\/div>\n\n\n\n<hr class=\"wp-block-separator is-style-default\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"has-text-align-center wp-block-heading\" style=\"font-size:35px\">D\u00e9roulement de l&rsquo;attaque <\/h2>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">En envoyant \u00e0 plusieurs reprises des paquets de demande de connexion initiale (<strong>SYN<\/strong>), l\u2019attaquant est en mesure de submerger tous les ports disponibles sur une machine serveur cibl\u00e9e, ce qui oblige l\u2019appareil cibl\u00e9 \u00e0 r\u00e9pondre lentement au trafic l\u00e9gitime, ou l\u2019emp\u00eache totalement de r\u00e9pondre.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/upload.wikimedia.org\/wikipedia\/commons\/thumb\/c\/c6\/Tcp_syn_flood.png\/400px-Tcp_syn_flood.png\" alt=\"SYN flood \u2014 Wikip\u00e9dia\"\/><\/figure><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Les <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong> sont fr\u00e9quemment effectu\u00e9es par des bots se connectant \u00e0 partir d\u2019<strong>adresses IP usurp\u00e9es<\/strong> afin de rendre l\u2019attaque plus difficile \u00e0 identifier et \u00e0 att\u00e9nuer. Les <strong>botnets <\/strong>peuvent lancer des <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong> en tant qu\u2019<a href=\"https:\/\/www.f5.com\/fr_fr\/services\/resources\/glossary\/distributed-denial-of-service-ddos-attack\" target=\"_blank\" rel=\"noreferrer noopener\">attaques par d\u00e9ni de service distribu\u00e9 (DDoS)<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator is-style-default\"\/>\n\n\n\n<div style=\"height:11px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Voil\u00e0 un exemple d&rsquo;attaque <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong> &amp; <strong><span style=\"color:#0693e3\" class=\"tadv-color\">DNS Flood<\/span><\/strong>:<\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood-ddos-attack.png\" alt=\"Imperva mitigates a 38 day-long SYN flood and DNS flood\u00a0multi-vector DDoS attack.\"\/><figcaption><em>Imperva mitigates a 38 day-long SYN flood and DNS flood&nbsp;<\/em><a href=\"https:\/\/www.imperva.com\/blog\/funded-persistent-multi-vector-ddos-attack\/\" target=\"_blank\" rel=\"noreferrer noopener\">multi-vector DDoS attack.<\/a><\/figcaption><\/figure><\/div>\n\n\n\n<hr class=\"wp-block-separator is-style-default\"\/>\n\n\n\n<h2 class=\"has-text-align-center wp-block-heading\" style=\"font-size:35px\">Prot\u00e9ger votre serveur contre le SYN Flood<\/h2>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Dans cet exemple, nous avons <strong>deux machines<\/strong> en local :<\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\" style=\"font-size:18px\">\u2b50 Une machine attaquante : <strong>192.168.1.27<\/strong><\/p>\n\n\n\n<p class=\"has-text-align-center wp-block-paragraph\" style=\"font-size:18px\">\u2b50Une machine victime : <strong>192.168.1.23<\/strong><\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Avant de vouloir prot\u00e9ger notre machine, nous allons voir un filtre <strong><span style=\"color:#00d084\" class=\"tadv-color\">wireshark<\/span><\/strong> nous permettant de d\u00e9tecter une attaque <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong>.<\/p>\n\n\n\n<pre class=\"wp-block-prismatic-blocks\"><code class=\"language-c\" data-line=\"\">tcp.flags.syn == 1 and tcp.flags.ack == 0<\/code><\/pre>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"726\" src=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3-1024x726.png\" alt=\"\" class=\"wp-image-1374\" srcset=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3-1024x726.png 1024w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3-300x213.png 300w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3-150x106.png 150w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3-768x545.png 768w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-3.png 1200w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure><\/div>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"839\" height=\"454\" src=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-4.png\" alt=\"\" class=\"wp-image-1381\" srcset=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-4.png 839w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-4-300x162.png 300w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-4-150x81.png 150w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-4-768x416.png 768w\" sizes=\"auto, (max-width: 839px) 100vw, 839px\" \/><\/figure>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Comme nous pouvons le voir, nous avons un tr\u00e8s grand nombre de <strong>paquets SYN<\/strong> en destination de notre victime qui est <strong>192.168.1.23<\/strong> et en provenance d&rsquo;<strong>adresse IP usurp\u00e9es<\/strong>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Nous pouvons aussi d\u00e9tecter une attaque <strong><span style=\"color:#cf2e2e\" class=\"tadv-color\">SYN Flood<\/span><\/strong> \u00e0 l&rsquo;aide de la commande suivante qui va nous renvoyer le nombre de connexion dans l&rsquo;\u00e9tat <strong><span style=\"color:#fcb900\" class=\"tadv-color\">SYN_RECV<\/span><\/strong> :<\/p>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<pre class=\"wp-block-prismatic-blocks\"><code class=\"language-bash\" data-line=\"\">netstat -npt | awk &#039;{print $6}&#039; | sort | uniq -c | sort -nr | head<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Il est temps d&rsquo;ajouter des param\u00e8tres nous permettant de <strong>limiter<\/strong> ce type d&rsquo;attaque.<\/p>\n\n\n\n<div style=\"height:5px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Dans un premier temps, nous allons travailler avec le fichier <strong>\/etc\/sysctl.conf<\/strong> puis changer les variables suivantes :<\/p>\n\n\n\n<div style=\"height:5px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<pre class=\"wp-block-prismatic-blocks\"><code class=\"language-bash\" data-line=\"\">net.ipv4.tcp_syncookies = 1\nnet.ipv4.tcp_max_syn_backlog = 2048\nnet.ipv4.tcp_synack_retries = 3\nnet.ipv4.conf.all.rp_filter = 1<\/code><\/pre>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\"> Pour plus d&rsquo;informations sur ces derni\u00e8res je vous recommande cet <a href=\"https:\/\/linoxide.com\/firewall\/snapshot-syn-flood-attack\/#:~:text=If%20you%20suspect%20a%20SYN,are%20in%20%E2%80%9CSYN_RECEIVED%E2%80%9D%20state.\" target=\"_blank\" rel=\"noreferrer noopener\">article<\/a>.<\/p>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Nous pouvons \u00e9galement mettre en place des r\u00e8gles <strong>iptables<\/strong> permettant de <strong>limiter<\/strong> ceci comme par exemple :<\/p>\n\n\n\n<div style=\"height:5px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<pre class=\"wp-block-prismatic-blocks\"><code class=\"language-markdown\" data-line=\"\"># Cr\u00e9ation d&#039;une nouvelle cha\u00eene nomm\u00e9e syn_flood\niptables -N syn_flood\n\n# Match les segments TCP pour cette derni\u00e8re\niptables -A INPUT -p tcp --syn -j syn_flood\n\n# Si la limite match alors on continue \u00e0 lire les autres r\u00e8gles\niptables -A syn_flood -m limit --limit 1\/s --limit-burst 3 -j RETURN\n\n# Si \u00e7a ne match pas on drop le paquet\niptables -A syn_flood -j DROP<\/code><\/pre>\n\n\n\n<div style=\"height:10px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<p class=\"has-text-align-center has-medium-font-size wp-block-paragraph\">Apr\u00e8s avoir mis en place ceci on constate que la cha\u00eene <strong>syn_flood<\/strong> commence \u00e0 <strong>DROP<\/strong> des paquets.<\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"737\" height=\"159\" src=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-5.png\" alt=\"\" class=\"wp-image-1391\" srcset=\"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-5.png 737w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-5-300x65.png 300w, https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/image-5-150x32.png 150w\" sizes=\"auto, (max-width: 737px) 100vw, 737px\" \/><\/figure><\/div>\n\n\n\n<div style=\"height:15px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator\"\/>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Sources : <\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>cloudflare<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>f5.com<\/li><\/ul>\n\n\n\n<ul class=\"wp-block-list\"><li>linoxide.com<\/li><\/ul>\n\n\n\n<div style=\"height:25px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n","protected":false},"excerpt":{"rendered":"<p><span class=\"span-reading-time rt-reading-time\" style=\"display: block;\"><span class=\"rt-label rt-prefix\"><\/span> <span class=\"rt-time\"> 3<\/span> <span class=\"rt-label rt-postfix\">min read<\/span><\/span>Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible. <a href=\"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/\" class=\"more-link\">Continuer la lecture <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":1323,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"footnotes":""},"categories":[4,2],"tags":[56,5,9,31,55],"class_list":["post-1300","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-infosec","category-network","tag-ddos","tag-infosec","tag-linux","tag-network","tag-tcp"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Mika\"\/>\n\t<meta name=\"keywords\" content=\"ddos,syn flood,iptables,ovh,cloudflare,attack,tcp,three-way handshake,cloudflare ddos,protection,infosec,linux,network\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Mika&#039;s Blog | Sysadmin, Network &amp; Infosec\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | DDoS | Mika&#039;s Blog\" \/>\n\t\t<meta property=\"og:description\" content=\"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-03-02T02:05:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-09-18T23:33:00+00:00\" \/>\n\t\t<meta property=\"article:author\" content=\"mikadmin\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | Mika&#039;s Blog\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@mika_sec\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg\" \/>\n\t\t<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t\t<meta name=\"twitter:data1\" content=\"Mika\" \/>\n\t\t<meta name=\"twitter:label2\" content=\"Estimation du temps de lecture\" \/>\n\t\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#article\",\"name\":\"Qu\\u2019est-ce qu\\u2019une attaque SYN Flood ? | DDoS | Mika's Blog\",\"headline\":\"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?\",\"author\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/author\\\/mikadmin\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/ddos-attack-feature-e1614639295349.png\",\"width\":175,\"height\":170},\"datePublished\":\"2021-03-02T03:05:00+01:00\",\"dateModified\":\"2021-09-19T01:33:00+02:00\",\"inLanguage\":\"fr-FR\",\"commentCount\":2,\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#webpage\"},\"articleSection\":\"infosec, network, ddos, infosec, linux, network, tcp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/mikadmin.fr\\\/blog\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/category\\\/network\\\/#listItem\",\"name\":\"network\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/category\\\/network\\\/#listItem\",\"position\":2,\"name\":\"network\",\"item\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/category\\\/network\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#listItem\",\"name\":\"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#listItem\",\"position\":3,\"name\":\"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/category\\\/network\\\/#listItem\",\"name\":\"network\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/#organization\",\"name\":\"Mika's Blog\",\"description\":\"Sysadmin, Network & Infosec\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/favicon.ico\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#organizationLogo\",\"width\":16,\"height\":16},\"image\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/author\\\/mikadmin\\\/#author\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/author\\\/mikadmin\\\/\",\"name\":\"Mika\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#authorImage\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/wp-content\\\/uploads\\\/2020\\\/10\\\/qV4LCrel_400x400-1-150x150.jpg\",\"width\":96,\"height\":96,\"caption\":\"Mika\"},\"sameAs\":[\"mikadmin\",\"https:\\\/\\\/twitter.com\\\/mika_sec\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#webpage\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/\",\"name\":\"Qu\\u2019est-ce qu\\u2019une attaque SYN Flood ? | DDoS | Mika's Blog\",\"description\":\"Une attaque SYN flood est un type d\\u2019attaque par d\\u00e9ni de service (DDoS) qui vise \\u00e0 rendre un serveur indisponible.\",\"inLanguage\":\"fr-FR\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/author\\\/mikadmin\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/author\\\/mikadmin\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/wp-content\\\/uploads\\\/2021\\\/03\\\/ddos-attack-feature-e1614639295349.png\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#mainImage\",\"width\":175,\"height\":170},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/syn-flood-attack-ddos\\\/#mainImage\"},\"datePublished\":\"2021-03-02T03:05:00+01:00\",\"dateModified\":\"2021-09-19T01:33:00+02:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/\",\"name\":\"Mika's Blog\",\"description\":\"Sysadmin, Network & Infosec\",\"inLanguage\":\"fr-FR\",\"publisher\":{\"@id\":\"https:\\\/\\\/mikadmin.fr\\\/blog\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | DDoS | Mika's Blog","description":"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.","canonical_url":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/","robots":"max-image-preview:large","keywords":"ddos,syn flood,iptables,ovh,cloudflare,attack,tcp,three-way handshake,cloudflare ddos,protection,infosec,linux,network","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#article","name":"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | DDoS | Mika's Blog","headline":"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?","author":{"@id":"https:\/\/mikadmin.fr\/blog\/author\/mikadmin\/#author"},"publisher":{"@id":"https:\/\/mikadmin.fr\/blog\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/ddos-attack-feature-e1614639295349.png","width":175,"height":170},"datePublished":"2021-03-02T03:05:00+01:00","dateModified":"2021-09-19T01:33:00+02:00","inLanguage":"fr-FR","commentCount":2,"mainEntityOfPage":{"@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#webpage"},"isPartOf":{"@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#webpage"},"articleSection":"infosec, network, ddos, infosec, linux, network, tcp"},{"@type":"BreadcrumbList","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog#listItem","position":1,"name":"Home","item":"https:\/\/mikadmin.fr\/blog","nextItem":{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog\/category\/network\/#listItem","name":"network"}},{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog\/category\/network\/#listItem","position":2,"name":"network","item":"https:\/\/mikadmin.fr\/blog\/category\/network\/","nextItem":{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#listItem","name":"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?"},"previousItem":{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#listItem","position":3,"name":"Qu&rsquo;est-ce qu&rsquo;une attaque  SYN Flood ?","previousItem":{"@type":"ListItem","@id":"https:\/\/mikadmin.fr\/blog\/category\/network\/#listItem","name":"network"}}]},{"@type":"Organization","@id":"https:\/\/mikadmin.fr\/blog\/#organization","name":"Mika's Blog","description":"Sysadmin, Network & Infosec","url":"https:\/\/mikadmin.fr\/blog\/","logo":{"@type":"ImageObject","url":"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2020\/10\/favicon.ico","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#organizationLogo","width":16,"height":16},"image":{"@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/mikadmin.fr\/blog\/author\/mikadmin\/#author","url":"https:\/\/mikadmin.fr\/blog\/author\/mikadmin\/","name":"Mika","image":{"@type":"ImageObject","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#authorImage","url":"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2020\/10\/qV4LCrel_400x400-1-150x150.jpg","width":96,"height":96,"caption":"Mika"},"sameAs":["mikadmin","https:\/\/twitter.com\/mika_sec"]},{"@type":"WebPage","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#webpage","url":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/","name":"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | DDoS | Mika's Blog","description":"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.","inLanguage":"fr-FR","isPartOf":{"@id":"https:\/\/mikadmin.fr\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#breadcrumblist"},"author":{"@id":"https:\/\/mikadmin.fr\/blog\/author\/mikadmin\/#author"},"creator":{"@id":"https:\/\/mikadmin.fr\/blog\/author\/mikadmin\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/mikadmin.fr\/blog\/wp-content\/uploads\/2021\/03\/ddos-attack-feature-e1614639295349.png","@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#mainImage","width":175,"height":170},"primaryImageOfPage":{"@id":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/#mainImage"},"datePublished":"2021-03-02T03:05:00+01:00","dateModified":"2021-09-19T01:33:00+02:00"},{"@type":"WebSite","@id":"https:\/\/mikadmin.fr\/blog\/#website","url":"https:\/\/mikadmin.fr\/blog\/","name":"Mika's Blog","description":"Sysadmin, Network & Infosec","inLanguage":"fr-FR","publisher":{"@id":"https:\/\/mikadmin.fr\/blog\/#organization"}}]},"og:locale":"fr_FR","og:site_name":"Mika's Blog | Sysadmin, Network &amp; Infosec","og:type":"article","og:title":"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | DDoS | Mika's Blog","og:description":"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.","og:url":"https:\/\/mikadmin.fr\/blog\/syn-flood-attack-ddos\/","og:image":"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg","og:image:secure_url":"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg","article:published_time":"2021-03-02T02:05:00+00:00","article:modified_time":"2021-09-18T23:33:00+00:00","article:author":"mikadmin","twitter:card":"summary","twitter:title":"Qu\u2019est-ce qu\u2019une attaque SYN Flood ? | Mika's Blog","twitter:description":"Une attaque SYN flood est un type d\u2019attaque par d\u00e9ni de service (DDoS) qui vise \u00e0 rendre un serveur indisponible.","twitter:creator":"@mika_sec","twitter:image":"https:\/\/www.imperva.com\/learn\/wp-content\/uploads\/sites\/13\/2019\/01\/syn-flood.jpg","twitter:label1":"\u00c9crit par","twitter:data1":"Mika","twitter:label2":"Estimation du temps de lecture","twitter:data2":"3 minutes"},"aioseo_meta_data":{"post_id":"1300","title":"#post_title | DDoS #separator_sa #site_title","description":"Une attaque&nbsp;SYN flood&nbsp;est un type d\u2019attaque par&nbsp;d\u00e9ni de service (DDoS)&nbsp;qui vise \u00e0 rendre un serveur indisponible.","keywords":[{"label":"ddos","value":"ddos"},{"label":"syn flood","value":"syn flood"},{"label":"iptables","value":"iptables"},{"label":"ovh","value":"ovh"},{"label":"cloudflare","value":"cloudflare"},{"label":"attack","value":"attack"},{"label":"tcp","value":"tcp"},{"label":"Three-way handshake","value":"Three-way handshake"},{"label":"cloudflare ddos","value":"cloudflare ddos"},{"label":"protection","value":"protection"}],"keyphrases":{"focus":{"keyphrase":"syn flood","score":100,"analysis":{"keyphraseInTitle":{"title":"Focus Keyphrase in SEO title","description":"Focus Keyphrase found in SEO title.","score":9,"maxScore":9,"error":0},"keyphraseInDescription":{"title":"Focus keyphrase in meta description","description":"Focus keyphrase found in meta description.","score":9,"maxScore":9,"error":0},"keyphraseInURL":{"title":"Focus Keyphrase in URL","description":"Focus Keyphrase used in the URL.","score":5,"maxScore":5,"error":0},"keyphraseLength":{"title":"Focus keyphrase length","description":"Good job!","score":9,"maxScore":9,"error":0,"length":2},"keyphraseInIntroduction":{"title":"Focus keyphrase in introduction","description":"Your Focus keyphrase appears in the first paragraph. Well done!","score":9,"maxScore":9,"error":0},"keyphraseInSubHeadings":{"title":"Focus Keyphrase in Subheadings","description":"Your H2 and H3 subheadings reflects the topic of your copy. Good job!","score":9,"maxScore":9,"error":0},"keyphraseInImageAlt":{"title":"Focus keyphrase in image alt attributes","description":"Focus keyphrase found in image alt attribute(s).","score":9,"maxScore":9,"error":0}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":[],"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":"#post_title #separator_sa #site_title","twitter_description":"Une attaque&nbsp;SYN flood&nbsp;est un type d\u2019attaque par&nbsp;d\u00e9ni de service (DDoS)&nbsp;qui vise \u00e0 rendre un serveur indisponible.","schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[],"defaultGraph":"Article","defaultPostTypeGraph":""},"schema_type":"default","schema_type_options":"{\"article\":{\"articleType\":\"BlogPosting\"},\"course\":{\"name\":\"\",\"description\":\"\",\"provider\":\"\"},\"faq\":{\"pages\":[]},\"product\":{\"reviews\":[]},\"recipe\":{\"ingredients\":[],\"instructions\":[],\"keywords\":[]},\"software\":{\"reviews\":[],\"operatingSystems\":[]},\"webPage\":{\"webPageType\":\"WebPage\"}}","pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","location":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2021-03-01 21:44:18","updated":"2025-06-17 16:28:32","seo_analyzer_scan_date":null},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1300","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/comments?post=1300"}],"version-history":[{"count":0,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/posts\/1300\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media\/1323"}],"wp:attachment":[{"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/media?parent=1300"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/categories?post=1300"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mikadmin.fr\/blog\/wp-json\/wp\/v2\/tags?post=1300"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}