Re: DOS attack tool can be used in lab

You could set a firewall rule to drop any incoming SYN packets from
the Internet, which is a very good idea anyway unless you have some
specific need for it (ie: this machine is on the DMZ & is a web
server).

On Mon, Sep 7, 2009 at 7:38 AM, L. Pop <zhiglee@xxxxxxxxx> wrote:
Thanks for your help!

Now i am clear that how we get attacked:
firtly they established tcp connection with us, then they just ignore
our "FIN" package,
server have to resend packet for 12 times, then send RST packet to give up.
The interval of retry gradually increases:
  [1st] 1s plus/minus 0.5s
  [2nd] 3s plus/minus 0.5s
  [3rd] 6s plus/minus 0.5s
  ....
  [7th] 64s plus/minus 0.5s
  [8th] 64s plus/minus 0.5s
  ....
  [12th] 64s plus/minus 0.5s


However, i am not confident to change those paramters, after all those
setting applys to all the tcp session. My OS is FreeBsd 6.4

Still need your help on how to prevent such attack.

Kind Regards,
Pop


2009/9/3 HD Moore <hdm@xxxxxxxxxxxxxxxxxx>:
On Wed, 2009-09-02 at 11:28 +0800, L. Pop wrote:
Hi Guys,

Recently one of our freebsd servers always experience "Socket: No
buffer space available..." Errors, and there are too many FIN_Wait1s
in system, it is likely that we are being DOSed.


Is there any handy DOS simulate tool that i can use in lab to
reproduce the problem. Thanks in advance!


This issue occurs when your side of the connection is trying to send
data, but the remote side stops receiving it (reduces the TCP window to
0 or a small value). With enough of these sessions, you start to hit
that message. I believe you can reproduce this with Slowaris:

http://ha.ckers.org/blog/20090617/slowloris-http-dos/



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

Relevant Pages

  • Re: custom handlers & dumb question
    ... tcp unlike udp is a reliable transport. ... acknowledgement, so if you can trust the status of a send (no need for own ... tcp has limited retry logic, so a PUT can often fail, but your packet send ... (iis buffering may prevent the server code from seeing this condition). ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Strange problem drive me mad.
    ... not by the TCP layer. ... > Thanks for reply, actually, the problem is that client (may caused by ... > always flush data before I decode the each packet when buffer is full. ...
    (microsoft.public.win32.programmer.networks)
  • Windows 2000 server cannot access Internet
    ... I have a Windows 2000 server which cannot access the Internet using TCP ... server sends a packet with the TCP window set to 0 bytes. ...
    (microsoft.public.windows.server.networking)
  • Re: How to send udp packets over the internet.
    ... I know of no web server that will respond to it. ... packet with the above contents for me. ... TCP does all the packet creation and I don't have to ... Header file references ...
    (comp.unix.programmer)
  • alt.2600 FAQ Revision .014 (2/4)
    ... One type of firewall is the packet filtering firewall. ... Dropping packets instead of rejecting them greatly increases the time required to scan your network. ... Port scanning UDP ports is much slower than port scanning TCP ports. ... Chartreuse Use the electricity from your phone line Cheese Connect two phones to create a diverter Chrome Manipulate Traffic Signals by Remote Control ...
    (alt.2600)