Application of SYN Cookies in Port Scanning
Introduction SYN Cookies were originally proposed to solve SYN Flood attacks. In high-concurrency network scanning, how to distinguish between TCP packets belonging to the scanner and normal traffic is a critical issue. Scanners (such as Masscan, ZMap) borrow the principle of Syncookies to verify responses without maintaining massive connection states, thereby improving scanning efficiency and reliability. This article will explain the application of Syncookies technology in scanning, combined with the implementation of Masscan. ...