LAND
In 1997, someone working under a pseudonym discovered a way to freeze a computer solid using a single, cleverly forged packet. That attack became known as LAND, short for local area network denial. It belongs to a class of cyberattacks called denial-of-service attacks, whose purpose is not to steal data but simply to render a machine useless. What made LAND particularly striking was how elegant the trick was, and how many different operating systems, from household names to industrial workhorses, turned out to be vulnerable. The questions this documentary explores are straightforward: how does a single packet cause a computer to lock up, which systems were caught unprepared, and what took so long for the problem to go away?
The mechanism behind LAND is disarmingly simple. An attacker crafts a spoofed TCP SYN packet, the kind normally used to initiate a network connection, and sets both the source and destination address to the target machine's own IP. The packet is then sent to an open port on that machine. When the target receives it, the machine believes it is talking to itself. It sends a reply to its own address, which triggers another reply, which triggers another, and so on in a continuous loop. The system ties itself in knots and locks up.
This is distinct from the TCP SYN Flood, a better-known denial-of-service technique. Where a SYN Flood works by overwhelming a target with a torrent of connection requests from many sources, LAND needs only a single carefully constructed packet to produce the same paralysing result. The flaw is not in traffic volume but in how certain operating systems handle the logical impossibility of a packet that claims to come from the very address it is being sent to.
Similar design flaws later turned up in other protocols and services, including SNMP and Windows port 88, which handles Kerberos and global services. Those systems shared the same underlying weakness: they would accept a request that appeared on the wire to originate from themselves, and then dutifully reply, setting off the same self-addressed loop.
When researchers compiled the list of vulnerable systems, the breadth was striking. AIX 3.0, AmigaOS with AmiTCP 4.2, BeOS in its Preview Release 2 on PowerMac hardware, BSDi versions 2.0 and 2.1, Digital VMS, and FreeBSD versions 2.2.5-RELEASE and 3.0 all appeared on it. So did HP's external JetDirect print servers, IBM's AS/400 running OS/400 version 3.7, and Irix 5.2 and 5.3.
Mac OS users running MacTCP on version 7.6.1 with OpenTransport 1.1.2, and those on version 8.0, were also exposed. NetApp NFS server versions 4.1d and 4.3 made the list, as did NetBSD from version 1.1 through 1.3, NeXTSTEP 3.0 and 3.1, Novell 4.11, and OpenVMS 7.1 with UCX 4.1-7. QNX version 4.24, the Rhapsody Developer Release, SCO OpenServer 5.0.2 SMP and 5.0.4, SCO Unixware 2.1.1 and 2.1.2, and SunOS 4.1.3 and 4.1.4 were all vulnerable.
Perhaps most consequential given their widespread consumer use, Windows 95, Windows NT, and Windows XP SP2 all appeared on that roster. The presence of Windows XP SP2 is particularly notable: that version was released years after the original 1997 discovery, meaning the vulnerability had resurfaced rather than been permanently resolved. Windows Server 2003 also reintroduced the flaw.
Firewalls offer the most straightforward defence. A properly configured firewall should intercept the poison packet and discard it before it ever reaches the target host. That interception breaks the loop before it starts. For networks running exposed systems, a firewall positioned between the internet and the vulnerable machine is the primary line of protection.
On the software side, some operating systems addressed the flaw by releasing targeted updates. FreeBSD versions 2.2.5-RELEASE and 3.0, for instance, were documented as fixed after required updates were applied. NetBSD versions 1.1 through 1.3 followed the same path. The fact that updates were the fix underscores that the vulnerability was a genuine design flaw in how these systems handled TCP, not a misconfiguration issue that administrators could resolve on their own.
The reappearance of the vulnerability in Windows Server 2003 and Windows XP SP2 serves as the clearest illustration of how persistent this class of flaw proved to be. New codebases, written years after the original patch cycle, replicated the same mistake. That pattern is a common challenge in network security: a fix applied to one version does not automatically carry forward when developers build fresh implementations of the same protocol.
Common questions
What is a LAND attack in network security?
A LAND (local area network denial) attack is a denial-of-service attack that sends a spoofed TCP SYN packet to a target computer with the target's own IP address set as both the source and destination. This causes the machine to reply to itself in a continuous loop, locking it up. It was first discovered in 1997.
When was the LAND denial-of-service attack first discovered?
The LAND attack was first discovered in 1997 by someone using an alias. The vulnerability later resurfaced in operating systems including Windows Server 2003 and Windows XP SP2, showing the flaw was not permanently eliminated after the initial discovery.
Which operating systems are vulnerable to the LAND attack?
Vulnerable systems include Windows 95, Windows NT, Windows XP SP2, FreeBSD 2.2.5-RELEASE and 3.0, NetBSD 1.1 to 1.3, Mac OS 7.6.1 and 8.0, SunOS 4.1.3 and 4.1.4, AIX 3.0, Irix 5.2 and 5.3, IBM AS/400 OS/400 3.7, and many others. HP external JetDirect print servers and NetApp NFS server versions 4.1d and 4.3 were also affected.
How does the LAND attack differ from a TCP SYN Flood?
The LAND attack uses a single spoofed packet with the target's own IP as both source and destination, causing the machine to loop replies to itself. A TCP SYN Flood works by overwhelming a target with a large volume of connection requests from many sources. The LAND attack exploits a logical flaw rather than traffic volume.
How can you protect against a LAND attack?
Most firewalls can intercept and discard the poison packet before it reaches the host, preventing the attack. Some operating systems also released patches that fixed the underlying vulnerability, including FreeBSD and NetBSD, which addressed the flaw after required updates were applied.
Did the LAND attack affect protocols other than TCP?
Yes. Similar LAND-style vulnerabilities were found in SNMP and Windows port 88, which handles Kerberos and global services. Those systems shared the same design flaw: they would accept a request appearing to originate from their own address and then send repeated replies.
All sources
1 references cited across the entry