# TRAP: A Three-Way Handshake Server for TCP Connection Establishment
## 6 Conclusions  
In this paper, we propose a TRAP, a TCP three-way handshake connection-establishing server.  
As any TCP connection establishment must go through the three-way handshake server, one can implement many functionalities on the TRAP. In this thesis, we configure the TRAP to defend against SYN flood DDoS attacks, but we believe that, with more extension modules, we can enhance the TRAP's ability to handle more functionality, like traffic filtering, user authentication, and more.  
We designed the TRAP as a modular component, so that each component can be replaced or updated independently, without sacrificing the overall performance.  
More importantly, a TRAP server can introduce more traffic filtration functionality, like host separation, authentication, and connection redirection, based on certain client information. We leave this for future works.  
With a tolerable one-time overhead, we can direct any future TCP connection to a remote server under many situations including, but not limited to, under a DDoS attack, virtual machine migration, and resource change. Additionally, since a DDoS attack is under the control of malicious users or unconscious bots, the above mentioned DDoS attack will not be interrupted from happening for some time. Still, it is also possible to protect our whole system from such threats.  
An attacker may redirect his payload and directly target our TRAP server, which may make our solution ineffective. However, when a packet originates from the TRAP server IP, it will then parse the client IP stored inside the TCP header option and the secret hash. If verified as a legitimate request, the server module will then store the IP address and allowing its further connection. The server module will drop any unauthorized packets. Additionally, we can put a stateful inspection firewall in the frontend of the network structure to drop some abnormal SYN packets, which is common in commercial use.  
Note that this solution cannot stop a DDoS attack from happening, but when an attack happens, we can effectively redirect authorized traffic to a remote, secure server to unload the burden of the original server being unable to provide service to any legitimate clients. If a DDoS attack deprecated all of the server's available bandwidth, clients may still be unable to connect to the TRAP. However, in a situation like this, we think any possible defense mechanism will have to rely on ISP-grade hardware or routers.  
**Acknowledgments: Our work is funded by Ministry of Science and Technology of Taiwan (ROC), and the numbers of the Projects are Most 105-2221-E-008 -074 -MY3 and MOST 104-2221-E-008-056-.**  
**Author Contributions: All authors contributed equally to this work. [PERSON] designed the study. [PERSON], [PERSON], [PERSON], [PERSON], [PERSON] and [PERSON] developed the methodology, collected data, and performed the analysis. [PERSON], [PERSON] and [PERSON] prepared the manuscript. [PERSON] and [PERSON] performed the experiments. [PERSON] communicated with the journal and coauthors and ensured the accuracy of all content in the proof.**  
**Conflicts of Interest: The authors declare no conflict of interest.**