Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

connection accepted, with the ACK bit used to distinguish between those two possibilities.
However, in the context of this report, the TCP SYN attack is a well-known denial of service
(DoS) attack that involves sending the target multiple TCP SYN messages with no intention of
following with an ACK. This forces the targets to process the SYN messages, to send out the
SYN/ACK messages, and to maintain a half-open connection while waiting for an ACK that
never arrives. The goal is to force the target to maintain so many of these connections that it is
not capable of accepting any further connections requests.
TCP—The state machine that underlies the Transmission Control Protocol (TCP) uses a number
of bits within the TCP Protocol Header. Various exploits leverage weaknesses in the TCP
protocol itself and implementations of the protocol. The primary bits are:
• The Urgent pointer (URG) is used to indicate a byte offset from the current sequence
number at which urgent data are to be found;
• The Acknowledgement number (ACK) is set to 1 indicates that the Acknowledgement
number field in the TCP protocol header is valid;
• The PUSHed data (PSH) bit requests the receiver to deliver the data to the application
upon arrival and not to buffer it until a full buffer has been received;
• The reset (RST) bit is used to reset a connection that has become confused due to a host
crash or some other reason;
• The synchronous (SYN) bit is used to establish connections; and
• The final (FIN) bit is used to release a connection. It specifies that the sender has no
more data to transmit. However, after closing a connection, a process may continue to
receive data indefinitely. Both SYN and FIN segments have sequence numbers and are
thus guaranteed to be processed in the correct order.
TCSEC—The U.S. Department of Defense developed the Trusted Computer System Evaluation
Criteria, which is used to evaluate operating systems, applications and systems. It is also known
as the “Orange Book” because it was originally issued with an orange cover. This criteria
provides a security metric that can be used to compare different systems. It also provides
direction for manufacturers so they can know what specifications to build to.
Threat—The potential for a threat-source to exercise (accidentally trigger or intentionally
exploit) a specific vulnerability (NIST 800-30).
160