CyberGlossary

Attacks & Threats

LAND Attack

Definition

A legacy DoS attack that sends a spoofed TCP SYN packet whose source IP and port equal the destination, causing vulnerable systems to loop or crash.

A LAND (Local Area Network Denial) attack crafts a TCP SYN where the source IP address and port equal the destination IP and port, so the target appears to be initiating a connection with itself. Older TCP/IP stacks (Windows 95/NT, certain BSD- and SunOS-era systems, some embedded devices) responded by getting stuck in a SYN/ACK loop, consuming CPU, locking up, or rebooting. Modern operating systems detect and drop such packets, but the pattern reappears in poorly tested IoT and industrial network stacks. Defences include ingress filtering of packets where source equals destination, edge ACLs that drop spoofed traffic for owned address space, and timely patching or replacement of legacy devices.

Examples

  • Sending a SYN packet from 10.0.0.1:80 to 10.0.0.1:80 to lock up an unpatched Windows 95 host.
  • A modern LAND-style packet causing a CPU spike on a vulnerable industrial controller.

Related terms