G.shdsl Router User Manual
Hacker 's
System
Target
System
Ping of Death Packet (112,000 bytes)
Normal IP Packet (Maximun 65,536 bytes)
Normal reassembled Packets
bytes from 1~1500
bytes from 1501~3000
bytes from 3000~4500
Reassembled teardrop packets
bytes from 1~1700
bytes from 1300~3200
bytes from 2800~4800
SYN Flood-
The attacker sends TCP SYN packet which start connections very fast, leaving the
victim waiting to complete a huge number of connections, causing it to run out of resources and
dropping legitimate connections. A new defense against this is the “SYN cookies”. Each side of a
connection has its own sequence number. In response to a SYN, the attacked machine creates a
special sequence number that is a “cookie” of the connection then forgets everything it knows
about the connection. It can then recreate the forgotten information about the connection where
the next packets come in from a legitimate connection.
Hacker 's
System
Target
System
Internet
TCP SYN
requests
Backing
quene
TCP SYN-ACK
Packets
ICMP Flood-
The attacker transmits a volume of ICMP request packets to cause all CPU
resources to be consumed serving the phony requests.
UDP Flood-
The attacker transmits a volume of requests for UDP diagnostic services which cause
all CPU resources to be consumed serving the phony requests.
Land attack-
The attacker attempts to slow your network down by sending a packet with identical
source and destination addresses originating from your network.
Smurf attack-
Where the source address of a broadcast ping is forged so that a huge number of
machines respond back to victim indicated by the address, overloading it.
Hacker 's
System
Multiple network
Subnet
Internet
Broadcast ping
request from spoofed
IP address
Target Router
Ping response
9
