How we did it

Passive monitoring devices were connected to a spanning port on the Cisco Catalyst 3500 switch on our target network. Inline devices were placed between our attacker and target networks, in front of the target network's gateway firewall. The target network consisted of a Red Hat 7.2 system running Apache, Sendmail, BIND and Secure Shell, and a Windows 2000 SP2 Server running Internet Information Server. The attack network consisted of a Red Hat Linux 7.2 system and a Win 2000 Professional SP2 system.

After initial setup on the network, we ran 48 hours of valid traffic, consisting of HTTP requests, DNS requests, mail requests and SSH connections to define an adequate baseline.

We launched a variety of attacks against the target network, including TFN SYN flood, Stacheldracht, Fragger, Mstream, Jolt2, Opentear, RC8, Pimp2, Land, Targa3, Naptha, and completely randomized source IP/TCP, User Datagram Protocol (UDP), and Internet Control Messaging Protocol SYN and ACK floods. We launched attacks in phases. Some were short bursts, others were sustained attacks lasting several hours, and others included multiple attacks launched at one time.

We also requested a 2M-byte file located on the Apache server several thousand times in rapid success to see if a sudden increase in valid connection attempts were identified as malicious. To test identification of outbound denial-of-service (DoS) attacks, we installed Tribe Flood Network 2000 on the test network and launched an attack against the systems on our attacker network.

To evaluate the security of the DoS device, we launched attacks against the device itself and ran Internet Security Systems' Internet Scanner against its IP addresses to identify any known vulnerabilities. Because most devices run on the Linux operating system, vulnerabilities in Linux could lead to a compromise of the DoS device.

Back to main review: "Denial of service: Fighting back"