How we did it
 
|
|||
 | |||
|
We set up a Gigabit Ethernet attack network with two servers, each a 900-MHz Pentium III with 128M bytes of RAM, as an attacker and a server. TrafficMaster Inspector sat in the middle of these two machines, monitoring and capturing all network traffic.
We launched a variety of distributed denial-of-service attacks using various tools and packet generators available at the Packetstorm Web site. Attacks included ping floods, ACK attacks, random ICMP floods, random IP floods and TCP reset floods. The ping flood attack sent a large number of Internet Control Messaging Protocol (ICMP) packets. The ACK attack sent a large number of TCP packets with the ACK flag set. The random ICMP floods sent a large number of ICMP packets with various aspects, such as IP address and time to live, randomized. The random IP floods sent a large number of randomized packets, and the TCP reset floods sent a large number of TCP packets with the reset flag set. With each attack, approximately 50,000 to 60,000 packets per second were sent across the network.
We also used a traffic generator (Traffic Source available here) to generate several hundred megabits of traffic to simulate a sudden increase in legitimate traffic to see if Inspector flagged it as suspicious. This traffic included HTTP, FTP, SMTP and general broadcast traffic.
RELATED LINKS
Andress is president of ArcSec Technologies, a security consultancy. Her new book, Surviving Security, was recently published. She can be reached at mandy@arcsec.com.
McAfee to fight DoS with Asta, Mazu and Arbor
McAfee announced it is teaming with anti-denial-of-service companies Mazu Networks, Asta Networks and Arbor Networks to develop a method of stopping DoS attacks.
IDG News Service, 08/20/01.
Start-up Mazu unveils device to stop DDoS attacks
The product is the TrafficMaster line of anti- distributed denial of service devices, a series of 1u (1.75-inch) tall devices that are installed as deep into a network as possible.
IDG News Service, 06/25/01.
Start-ups vie to defeat DoS attacks
Nobody's claiming it's easy to prevent and stop denial-of- service attacks, but three security start-ups are vying to prove that they can minimize the threat.
Network World, 02/05/01.
