All DDoS Definitions
DDoS Testing Definition

LAND Attack

The LAND attack was first documented in 1997, when a poster known as m3lt showed that a single crafted packet could freeze a machine with no flood behind it at all. It still matters because the same trick resurfaces every time a new TCP/IP stack ships without the check that kills it, which is exactly why a thorough DDoS test exercises malformed-packet handling and not only capacity.

It sits in the malformed-packet family, whose members each take a host down with one carefully wrong packet instead of a flood, alongside the teardrop and the ping of death. What is specific to LAND is the deformity: a packet addressed to itself.

LAND attack: a SYN addressed from the target to itself Crafted TCP SYN src 198.51.100.7 : 80 dst 198.51.100.7 : 80 source = destination self-addressed, spoofed flag never legitimate Target host appears to open a connection to itself SYN-ACK to itself Modern kernel / ingress filter drops self-addressed packet the control under test Vulnerable stack (historical) loops on its own SYN-ACK CPU spins, host hangs Largely historical against patched systems, but still a clean probe of anti-spoofing filters A test confirms the edge drops obviously spoofed, self-addressed packets before they reach the host. BlackNeuron™
A LAND attack crafts a TCP SYN whose source equals its destination so the target appears to open a connection to itself; a modern kernel or ingress filter drops the self-addressed packet.

The self-addressed packet

The attacker crafts a TCP SYN whose source IP and source port are set equal to the destination IP and destination port. The packet therefore appears to arrive from the target, addressed to the target, opening a connection from a host to itself.

A vulnerable stack follows its state machine faithfully. It answers the SYN with a SYN-ACK, which it then receives as if from a peer, acknowledges, and processes again. The connection folds back on itself, and on the stacks that were affected this became a tight loop or a degenerate half-open entry that consumed CPU until the machine stalled. The name is short for Local Area Network Denial.

The essential property is that the packet is invalid by inspection. No legitimate datagram has its source address equal to its destination address, so the deformity needs no connection context to recognize and reject.

That single detail is what separates LAND from its siblings. A teardrop underflows the arithmetic in fragment reassembly; a ping of death overflows the reassembled total; a Christmas tree sets contradictory flags to force the stack down an expensive parsing branch. LAND corrupts none of those. Its deformity is purely in the addressing, and the failure it triggers is a loop rather than a parser crash. Same family, different trigger.

Why it still matters

The original bug was widespread. In 1997 it hung Windows 95 and NT, several Unix stacks, and a long list of routers and printers whose firmware trusted the source address without question. Vendors fixed it with a one-line guard: drop any packet whose source equals its destination.

Then it came back. In 2005 a LAND variant felled Windows XP SP2 and Windows Server 2003, because a reworked code path had quietly lost the check the previous generation had added. The specific bug was patched in the 1990s and patched again a decade later, which is the whole point: the class outlives any single fix.

Because the check has to be re-added by hand in each implementation, a fresh stack is a fresh opportunity to leave it out. The place the guard is most often missing is embedded and appliance firmware, which lags the desktop stacks by years, so a self-addressed packet still finds unpatched targets there. One packet is enough, so there is nothing for a bandwidth monitor to alarm on: the event has no size.

LAND attack: a SYN addressed to itself ordinary TCP, source and destination differ one SYN: source = destination TCP stack connection state machine self-reply host hangs No legitimate packet has its source equal to its destination, so the edge can drop it with no connection context BlackNeuron™
Animated LAND attack: ordinary TCP packets with distinct endpoints pass, then one SYN whose source equals its destination reaches the stack, which answers its own SYN-ACK and loops until the host hangs.

What a DDoS test measures

A LAND case is built to be caught, not to gauge capacity, so the packet has to be crafted deliberately: a SYN, usually, whose source IP and port are set to match the destination, assembled with a tool such as hping3. A case that does not create that self-reference is testing nothing.

The test confirms two things. First, that the edge and the host drop self-addressed packets before they reach the connection logic, and that they do so on every interface rather than only the internet-facing one. An attacker with a foothold inside can aim a LAND at an internal service the perimeter never sees, so a filter present only at the border is not enough. Source-address validation (BCP 38) is the same one rule that covers this and the wider spoofing surface, because a source equal to the destination is the most obvious spoof there is.

Second, that the boxes ahead of the origin handle it too. A load balancer or firewall that terminates or forwards the connection has its own stack and can be the thing that loops, so a case that only reaches the server leaves the front door untested. It is worth varying the flags and ports as well, since a stack can guard one path and miss another.

Where LAND fits among the network-layer vectors, and why a handful of them defeat a host through a broken code path rather than a full pipe, is laid out in Understanding DDoS Attack Vectors.