- The server will
process a
bogus/legitimate
connection request
in the same way
(see the preliminary discussion above):
- The server will
acknowledge the
SYN (connection) request
and
also send a
its own
SYN request:
- This is the same response
to a
legitimate connection request:
- The server will
acknowledge the
SYN (connection) request
and
also send a
its own
SYN request:
- The client's
response to
a legitimate connection request
was discussed
previously:
- When a legitimate
connection request
is received:
The client can use the TCP connection record data to verify the response:
Specifically:
- The TCP connection identifiers (srcIP, srcPort#, destIP, destPort#) must match
- The ACK no must be 1 more than the Seq no of the TCP connection record
- If the
server's response is
correct, the
client sends
an ACK:
(We have seen this response action previously !!!)
- When a legitimate
connection request
is received:
- The client's
response to
a bogus connection request
is as follows:
- The client can
detect a
bogus response from
the server because
- The client does
not have
any information on the
TCP connection
(Recall a TCP connection is identified by (srcIP, srcPort#, destIP, destPort#))
Graphically:
- The client does
not have
any information on the
TCP connection
- The client will
reject the
SYN message
by sending a
RESET message :
Note:
- The RESET message must contain the TCP connection identifier !!!
When the server receives the RESET message message:
- The server will remove the TCP connection record created by the bogus connection request
- The client can
detect a
bogus response from
the server because