A denial-of-service attack (also, DoS attack) is an attack on a computer system or network thatically the loss of network connectivity and services by consuming the bandwidth of the victim network or overloading the computational resources of the victim system.
Methods of attack
A DoS attack can be perpetrated in a number of ways. There are three basic types of attack:
- consumption of con information, such as routing information
- disruption of physical network components
A smurf attack is one particular variant of a DoS attack on the public Internet. It relies on mis-configured network devices that allow packets to be sent to all s on a particular network, rather than a specific machine. In such an attack, the perpetrators will send large numbers of IP packets with a faked source addressed victim. To combat Denial of Service attacks on the Internet, services like the Smurf Amplifier Registry have given network service providers the ability to identify mis-configured networks and to take appropriate action such as filtering.
Attempts to "flood" a network with bogus packets, thereby preventing legitimate network traffic, are the most common form of attack, often conducted by disrupting network connectivity with the use of multiple hosts in a distributed denial-of-service attack or DDoS. Specific means of attack include: a smurf attack, in which excessive ICMP requests are broadcast to an eus HTTP requests on the World Wide Web; incorrectly formed packets; and randomue origin of the attack. Due to protect against denial-of-service attacks, and it is a difficult feat to determine the source of the attack and the identity of the attacker. This is especially true with distributed attacks.
Attacks can be directed at any net, including attacks on routing devices and Web, electronic mail, or Domain Name System servers.
Distributed denial-of-service attacks
In a distributed attack, the attacking computer hosts are often personal computers with broadband connections to the Internet that have been compromised by viruses (or, more commonly, these days, [[Trojan horse (computing)| allow the perpet remotely control the machine and direct the attack, often through a botnet. With enough such slave hosts, the services of even the largest and most well-connected websites can be denied.
Surviving distributed attacks
There are steps that can be taken to mitigate the effects of a DDoS attack. As mentioned in the previous section, the first thing to start is the investigative process. One determines which core router (a router that handles Internet backbone traffcontact the owners of the core router, likely a telecom company or the ISP, and inform them of his or her problem. Ideally, there will be a process in place which can expedite one's requests for help. They, in turn, need to determine where the malicious traffic reaches their network and contact the source. By that point, it is out of one's hands.
Since it's not likely that the administrator will be able to quickly stop the DDoS flood, there are a few steps which might help mitigate the attack tenal DNS servers and given to a few crucial external users. This is especially useful for key servers (e.g. email or database) under attack on one's network.
There is a chance that some filtering techniques can help. If the attack is unsophisticated, there might be a specific signature to the traffic. A careful examination of captured packets sometimes reveals a trait on which you can base either router [[Access Control List|ccess control lists) or firewall rules. Additionally, a large amount of traffic may originate from a specific provider or core router. If that is the case, one might consider temporarily blocking all traffic from that source, which should allow a portion of legitimate activity through. One would also be blocking "real" packets, or legitimate traffic, but this may be an unavoidable sacrifice.
A final option, one which might be available to larger companies and networks, is to throw more hardware or bandwidth at the flooout. Again, it is not the best solution, nor the least expensive one. It may provide a temporary fix, nevertheless.
The investigative process should begin immediately after the DoS attack begins. There will be multiple phone calls, call backs, emails, pages and faxes between the victim organization, one's provider and others involved. It is a time consuming process, so the processin immediately. It has taken some very large networks with plenty of resources several hours to halt a DDoS.
External links
- Distributed Reflection Denial of Service
- [htchool.netfirms.com/computer-article-denial-of-service.html Distributed Denial of Service Attacks] - general information of Distributed Denial of Service Attacks (DDoS)
- DDoSVax Research Project - at Swiss Federal Institute of Technology in Zürich
- DDoS Mitigation Techniques - research papers and presentations