A T T A C K D E T E C T I O N A N D P R E V E N T I O N
About Denial of Service (DoS and DDoS) Attacks
5-4
Security Appliance User Guide
Version 3R2
5
A B O U T D E N I A L O F S E R V I C E ( D O S A N D
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
D D O S ) A T T A C K S
Not all attacks attempt to gain unauthorized access into a protected
network. Some attacks attempt to hinder normal network activity by
sending large amounts of bogus data consuming all of the resources on
that host or hosts. These attacks are called denial of service (DoS) or
distributed denial of service (DDoS) attacks.
Table 5-2
lists these
attacks.
Table 5-2: DoS and DDoS Attacks
Attack Name
Description
Smurf Attack
Swamps an Internet connection with many ICMP reply messages. The
attack happens when a hacker sends an ICMP request to an Internet
Broadcast address causing all of the machines on that network to
reply. Since the IP address is likely a spoofed one, access to the
Internet for t he machine is cut off.
Fraggle Attack
Very similar to a smurf attack, but performed over UDP instead of
ICMP.
Land Attack
An attacker sends a packet with the same source and destination
information as another machine on a network. This causes the real
machine on the network to think that it sent the packet to itself,
causing a resource slowdown.
SYN-Flood
Uses packets that have an unreachable source address to establish a
large number of connections. This type of attack exhausts all
resources available on a network device so it no longer processes valid
requests.
Ping of Death
Sends a large IP packet request that is larger than 65,536. Since IP
allows fragmentation, an attacker could send multiple IP packets that,
when assembled, are larger than 65,536. This causes systems to
crash or freeze.
Teardrop Attack
An attacker sends a large data packet in need of fragmentation. This
fragmentation enables the attacker to set an offset at the beginning of
the packet, allowing the end machine to reassemble the large packet.
During reassembly, the hacker uses a confusing offset that might
crash the receiving machine or cause it to go offline.
UDP Bomb
Enable hackers to craft packets with illegal values in certain fields. If
these packets reach older machines, these illegal packets might crash
the machine.
WinNuke
A DoS attack targeted at machines running Windows. Using the
NetBIOS port 139, an attacker sends a TCP packet with an urgent
(URG) flag to a host with an established connection, causing the
Windows machine to crash.
