All DDoS Definitions
DDoS Testing Definition

LAND Attack

A LAND attack is a Layer 4 (transport) attack vector, one of the classic classes a thorough DDoS test is built to exercise. The attacker crafts a TCP SYN packet whose source IP and port are set equal to the destination IP and port, so the target appears to be opening a connection to itself. A vulnerable stack replies to its own SYN-ACK in a loop, consuming CPU and potentially hanging. Modern kernels drop such packets, but the vector persists as a test for spoofing filters and malformed-packet handling.

LAND attack: a SYN addressed from the target to itself Crafted TCP SYN src 198.51.100.7 : 80 dst 198.51.100.7 : 80 source = destination self-addressed, spoofed flag never legitimate Target host appears to open a connection to itself SYN-ACK to itself Modern kernel / ingress filter drops self-addressed packet the control under test Vulnerable stack (historical) loops on its own SYN-ACK CPU spins, host hangs Largely historical against patched systems, but still a clean probe of anti-spoofing filters A test confirms the edge drops obviously spoofed, self-addressed packets before they reach the host. BlackNeuron™
A LAND attack crafts a TCP SYN whose source equals its destination so the target appears to open a connection to itself; a modern kernel or ingress filter drops the self-addressed packet.

Why it matters in DDoS testing

LAND is largely historical against patched systems, yet it still probes a real control: whether the edge drops obviously spoofed and self-addressed packets before they reach the host. Testing confirms that ingress filtering and anti-spoofing rules catch malformed source addresses rather than passing them inward. The role of spoofing across attack classes is detailed in Understanding DDoS Attack Vectors.