Each packet's IP address is spoofed. MAC addresses are not spoofed. It is up to you to spoof your MAC Address beforehand if desired.

This attack may only work on web servers susceptible to numerous half-open connections (SYN_RECV).

To demonstrate this, a small Ubuntu Mate running Apache2 will act as the target. It's a physical machine on a private network.

---

1. The tcp_syncookies flag was set to 0 (to make the target vulnerable for demonstration purposes) and the webserver was started on the target:

2. The attacker machine (a separate physical machine also running Ubuntu) executes the gosynflood exe with root privileges:

3. The initial SYNs are visible in Wireshark on the target, purposefully never completing the thee 3-way handshake:

4. During the attack the webserver should be unreachable at it's URL if it is susceptible. The half-open connections are visible via the command netstat -na --tcp

This was developed on Ubuntu 18.04 LTS.

---

Author: rootVIII 2020