Motorola Solutions WiNG 5.2.6, Reference Manual

Page: 365 / 670

Security Configuration 7 - 5
LAND The LAND DoS attack sends spoofed packets containing the SYN flag to
the target destination using the target port and IP address as both the
source and destination. This will either crash the target system or result in
high resource utilization slowing down all other processes.
Option Route Enables the IP Option Route denial of service check in the firewall.
Router
Advertisement In this attack, the attacker uses ICMP to redirect the network router
function to some other host. If that host can not provide router services, a
DoS of network communications occurs as routing stops. This can also be
modified to single out a specific system, so that only that system is subject
to attack (because only that system sees the 'false' router). By providing
router services from a compromised host, the attacker can also place
themselves in a
man-in-the-middle situation and take control of any open
channel at will (as mentioned earlier, this is often used with TCP packet
forgery and spoofing to intercept and change open TELNET sessions).
Router Solicit The ICMP Router Solicitation scan is used to actively find routers on a
network. Of course, a hacker could set up a protocol analyzer to detect
routers as they broadcast routing information on the network. In some
instances, however, routers may not send updates. For example, if the local
network does not have other routers, the router may be configured to not
send routing information packets onto the local network.
ICMP offers a method for router discovery. Clients send ICMP router
solicitation multicasts onto the network, and routers must respond (as
defined in RFC 1122).
By sending ICMP Router Solicitation packets (ICMP type 9) on the network
and listening for ICMP Router Discovery replies (ICMP type 10), hackers
can build a list of all of the routers that exist on a network segment.
Hackers often use this scan to locate routers that do not reply to ICMP echo
requests
Smurf The Smurf DoS Attack sends ICMP echo requests to a list of broadcast
addresses in a row, and then repeats the requests, thus flooding the
network.
Snork The Snork DoS attack uses UDP packet broadcasts to consume network
and system resources.
TCP Bad Sequence Enables a TCP Bad Sequence denial of service check in the firewall.
TCP FIN Scan Hackers use the TCP FIN scan to identify listening TCP port numbers based
on how the target device reacts to a transaction close request for a TCP
port (even though no connection may exist before these close requests are
made). This type of scan can get through basic firewalls and boundary
routers that filter on incoming TCP packets with the Finish (FIN) and ACK
flag combination. The TCP packets used in this scan include only the TCP
FIN flag setting.
If the target device's TCP port is closed, the target device sends a TCP RST
packet in reply. If the target device's TCP port is open, the target device
discards the FIN and sends no reply.