SMARTLINK
I&II
MDS921AE-10BTS - MDS
Denial of Service Attack
Denial of service (DoS) attacks typically come in two flavors: resource starvation and resource
overload. DoS attacks can occur when there is a legitimate demand for a resource that is greater
than the supply (i.e. too many w
vulnerabilities or system misconfigurations
a malicious denial of service and simple system overload is the requirement of an individual with
malicious intent (attacker) using or attempting to use resources specifically to deny those
resources to other users.
Ping of death-
On the Internet, ping of death is a kind of denial of service (DoS) attack caused by
an attacker deliberately sending an IP packet larger than the 65,536 bytes allowed by the IP
protocol. One of the features of TCP/IP is fragmentation; it allows a single
down into smaller segments. Attackers began to take advantage of that feature when they found
that a packet broken down into fragments could add up to more than the allowed 65,536 bytes.
Many operating systems didn't know what to do
froze, crashed, or rebooted. Other known variants of the ping of death include teardrop, bonk and
nestea.
SYN Flood-
The attacker sends TCP SYN packet which start connections very fast, leaving the
victim waiting to complete a huge number of connections, causing it to run out of resources and
dropping legitimate connections. A new defense against this is the “SYN cookies”. Each side of a
connection has its own sequence number. In response to a SYN, the attack
special sequence number that is a “cookie” of the connection then forgets everything it knows
about the connection. It can then recreate the forgotten information about the connection where
the next packets come in from a legitimate co
ICMP Flood-
The attacker transmits a volume of ICMP request packets to cause all CPU
resources to be consumed serving the phony requests.
UDP Flood-
The attacker transmits a volume of requests for UDP diagnostic services which cause
all CPU resources to be consumed serving the phony requests.
Land attack-
The attacker attempts to slow your network down by sending a packet with identical
source and destination addresses originating from your network.
Smurf attack-
Where the source address of a broadcast ping is forged so that a huge number of
machines respond back to victim indicated by the address, overloading it.
Fraggle Attack-
A perpetrator sends a large amount of UDP echo packets at IP broadcast
addresses, all of it having a spoofed source address of a victim.
IP Spoofing-
IP Spoofing is a method of masking the identity of an intrusion by making it appeared
that the traffic came from a different computer. This is used by intruders to keep their anonymity
and can be used in a Denial of Service attack.
S957AE-10BTS User Manual
Page 12 of 113
Attack
Denial of service (DoS) attacks typically come in two flavors: resource starvation and resource
overload. DoS attacks can occur when there is a legitimate demand for a resource that is greater
than the supply (i.e. too many web requests to an already overloaded web server). Software
configurations can also cause DoS situations. The difference between
a malicious denial of service and simple system overload is the requirement of an individual with
alicious intent (attacker) using or attempting to use resources specifically to deny those
On the Internet, ping of death is a kind of denial of service (DoS) attack caused by
an attacker deliberately sending an IP packet larger than the 65,536 bytes allowed by the IP
protocol. One of the features of TCP/IP is fragmentation; it allows a single IP packet to be broken
down into smaller segments. Attackers began to take advantage of that feature when they found
that a packet broken down into fragments could add up to more than the allowed 65,536 bytes.
Many operating systems didn't know what to do when they received an oversized packet, so they
froze, crashed, or rebooted. Other known variants of the ping of death include teardrop, bonk and
The attacker sends TCP SYN packet which start connections very fast, leaving the
iting to complete a huge number of connections, causing it to run out of resources and
dropping legitimate connections. A new defense against this is the “SYN cookies”. Each side of a
connection has its own sequence number. In response to a SYN, the attacked machine creates a
special sequence number that is a “cookie” of the connection then forgets everything it knows
about the connection. It can then recreate the forgotten information about the connection where
the next packets come in from a legitimate connection.
The attacker transmits a volume of ICMP request packets to cause all CPU
resources to be consumed serving the phony requests.
The attacker transmits a volume of requests for UDP diagnostic services which cause
sources to be consumed serving the phony requests.
The attacker attempts to slow your network down by sending a packet with identical
source and destination addresses originating from your network.
Where the source address of a broadcast ping is forged so that a huge number of
machines respond back to victim indicated by the address, overloading it.
A perpetrator sends a large amount of UDP echo packets at IP broadcast
l of it having a spoofed source address of a victim.
IP Spoofing is a method of masking the identity of an intrusion by making it appeared
that the traffic came from a different computer. This is used by intruders to keep their anonymity
can be used in a Denial of Service attack.
Denial of service (DoS) attacks typically come in two flavors: resource starvation and resource
overload. DoS attacks can occur when there is a legitimate demand for a resource that is greater
eb requests to an already overloaded web server). Software
can also cause DoS situations. The difference between
a malicious denial of service and simple system overload is the requirement of an individual with
alicious intent (attacker) using or attempting to use resources specifically to deny those
On the Internet, ping of death is a kind of denial of service (DoS) attack caused by
an attacker deliberately sending an IP packet larger than the 65,536 bytes allowed by the IP
IP packet to be broken
down into smaller segments. Attackers began to take advantage of that feature when they found
that a packet broken down into fragments could add up to more than the allowed 65,536 bytes.
when they received an oversized packet, so they
froze, crashed, or rebooted. Other known variants of the ping of death include teardrop, bonk and
The attacker sends TCP SYN packet which start connections very fast, leaving the
iting to complete a huge number of connections, causing it to run out of resources and
dropping legitimate connections. A new defense against this is the “SYN cookies”. Each side of a
ed machine creates a
special sequence number that is a “cookie” of the connection then forgets everything it knows
about the connection. It can then recreate the forgotten information about the connection where
The attacker transmits a volume of ICMP request packets to cause all CPU
The attacker transmits a volume of requests for UDP diagnostic services which cause
The attacker attempts to slow your network down by sending a packet with identical
Where the source address of a broadcast ping is forged so that a huge number of
A perpetrator sends a large amount of UDP echo packets at IP broadcast
IP Spoofing is a method of masking the identity of an intrusion by making it appeared
that the traffic came from a different computer. This is used by intruders to keep their anonymity
