CTC Union SHDTU03b, Руководство пользователя

Страница: 15 / 96

15
Level 5: Application
Level 4: TCP
Level 3: IP
Level 2: Data Link
Level 1: Physical
Telnet
FTP
Http
SMTP
Host PC
Proxy Server
Public Server
Request Page
Check URL
Request Page
Return Page
Return Page
Filter Content
External
Interface
Internal
Interface
Proxy Application
2.2 Denial of Service Attack
Typically,
Denial Of Service (DoS) attacks result in two flavors:
resource starvation and system overloading. DoS attacks
happen usually when a legitimate resource demanding is
greater than the supplying (ex. too many web requests to an
already overloaded web server). Software weakness or system
incorrect configurations induce DoS situations also. The difference between a malicious denial of
service and simple system overload is the requirement of an individual with malicious intent (attacker)
using or attempting to use resources specifically to deny those resources to other users.
Ping of death- On the Internet, ping of death is a kind of denial of service (DoS) attack caused by
deliberately sending an IP packet which size is larger than the 65,536 bytes allowed in the IP protocol.
One of the features of TCP/IP is fragmentation, which allows a single IP packet to be broken down into
smaller segments. Attackers began to take advantage of that feature when they found that fragmented
packets could be added up to the size more than the allowed 65,536 bytes. Many operating systems
don’t know what to do once if they received an oversized packet, then they freeze, crash, or reboot.
Other known variants of the ping of death include teardrop, bonk and nestea.
Hacker 's
System
Target
System
Ping of Death Packet (112,000 bytes)
Normal IP Packet (Maximun 65,536 bytes)
Inturruption