A LAND attack is a denial of service technique that tricks a target into responding to itself. The attacker forges packets so the source and destination appear to be the same host, which can overload older systems or network stacks by creating endless internal reply processing and resource exhaustion.
What Makes a LAND Attack Work
A LAND attack exploits a protocol edge case rather than a complex exploit chain. By forging packets so the source and destination resolve to the same host, it can make a target process its own traffic repeatedly until older stacks, fragile services, or under-protected network devices waste CPU, memory, and connection state.
The practical danger is that the attack can appear deceptively simple while still causing disproportionate disruption. Because the packet contents are syntactically valid, the system may spend resources trying to answer traffic that should never have been accepted in the first place.
Why LAND Attacks Disrupt Systems
The core failure mode is recursive self-response. A vulnerable host or network stack can enter a loop of internal reply handling, queue growth, or exception processing, which consumes resources faster than ordinary traffic does.
This matters most where the target has weak input validation, legacy TCP/IP handling, or limited resilience under malformed traffic. Even when modern systems no longer fail in the same way, the attack pattern still illustrates how trust in packet metadata can become a denial-of-service condition.
LAND attacks are usually discussed alongside classic network-layer denial of service techniques because they abuse a trust assumption at the protocol boundary, not an application bug. That makes them useful as a reminder that defensive filtering should reject impossible source and destination combinations before they reach sensitive network paths.
How Organisations Reduce Exposure to Spoofed-Address DoS
Exposure is typically assessed by looking for legacy hosts, embedded devices, outdated operating systems, and network segments that still accept malformed or spoofed traffic. The most useful checks are inventory-driven: know which systems are still running old stacks, whether they are internet reachable, and whether upstream filtering actually blocks obviously invalid packets.
Vendor advisories and platform hardening guidance are the authoritative sources for version-specific behaviour, especially where a device family or OS generation has known weaknesses in packet handling. For broader defensive baselines, NIST SP 800-53 Rev 5 Security and Privacy Controls helps anchor network filtering, boundary protection, and monitoring expectations.
Network teams also use upstream controls such as ingress filtering, anti-spoofing rules, and segmentation to prevent impossible source and destination relationships from reaching sensitive hosts. In larger environments, the relevant question is not only whether one system is patched, but whether the surrounding network architecture makes spoofed traffic harder to deliver in the first place.
Detection and Recovery After Suspicious Traffic
Detection often starts with abnormal retry patterns, interface saturation, unexpected CPU spikes, or logs showing repeated self-addressed traffic. Because the attack is noisy at the packet level but specific in shape, analysts should look for packets where the apparent source and destination are identical or where a host is replying to traffic that it should not logically originate.
If compromise is suspected, the post-event review should include packet captures, firewall logs, and device telemetry to confirm whether the traffic was a LAND-style probe or part of a broader flood. Where service disruption occurred, verify whether any secondary failures followed, such as watchdog resets, stale sessions, or recovery loops in dependent systems.
For organisations that use structured monitoring and response playbooks, NIST Cybersecurity Framework 2.0 provides a useful control lens for identifying, detecting, responding to, and recovering from denial-of-service conditions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | LAND attacks exploit weak network boundary filtering and spoofed traffic acceptance. |
| Recommendation — Enforce boundary filtering to block impossible source and destination combinations before they reach internal hosts. | ||
| NIST CSF 2.0 | PR.PS-01 — Identity Management, Authentication, and Access Control | Spoofed packet acceptance reflects weak control over trusted network ingress and traffic acceptance. |
| DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | LAND attacks are detected by monitoring anomalous self-addressed traffic and resource spikes. | |
| Recommendation — Tighten access paths so only legitimate traffic patterns are accepted by exposed systems. Monitor network traffic for malformed or self-referential packets and escalate denial-of-service indicators quickly. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | This attack is a network-layer abuse pattern that network defense controls are meant to spot and limit. |
| Recommendation — Filter spoofed packets and alert on denial-of-service signatures at the network edge. | ||
| MITRE ATT&CK | T1498 — Network Denial of Service | LAND is a classic denial-of-service technique that consumes target resources through crafted traffic. |
| Recommendation — Map LAND-style traffic to T1498 and tune detections for resource-exhaustion patterns. | ||
Practitioner Guidance
Why practitioners should care: LAND attacks are a reminder that denial of service does not always require bandwidth exhaustion alone; protocol misuse can be enough to degrade weak targets. The safest posture is to treat impossible source-destination combinations as invalid traffic and stop them before they reach legacy systems.
What to watch for: Pay close attention to older hosts, embedded appliances, and any perimeter path that still allows spoofed packets or lacks basic anti-spoofing enforcement. If a system is unusually sensitive to malformed traffic, it deserves priority in hardening and segmentation planning.