Re: Fragmentation Attack

[Gandalf The White <gandalf@digital.net>]

[-- Attachment #1: Type: text/plain, Size: 2223 bytes --]

Greetings and Salutations:

On 2/7/04 11:45 AM, "David S. Miller" <davem@redhat.com> wrote:
> What makes your DoS interesting is whether the attacker needs
> a lot of bandwidth or not.  Ie. if he has to be sitting on your
> gigabit subnet then the attack isn't interesting.  Whereas if he
> can eat all of the remote systems cpu cycles just being behind a
> cable modem, that's interesting.
> Which is it?

The network that I was working on was a 100Mb network.  This is (of course)
lots of packets at one time.  Attached is the excerpt from paper, I was
sending somewhere around 780 packets Per Second (I didn't know if
attachments were allowed to the list at first, but I saw a attachment in one
of the e-mails).

The requirements of the attack (from the perspective of the paper I wrote)
was that you had taken over 20 cable modem computers.  From this viewpoint
this could (of course) produce the required number of packets IMHO.

Of course you could also clog up the bandwidth of just about any destination
network with this requirement, but that is a different DoS.

> Also have you done your cpu utilization tests on something a little
> less ancient than a 450mhz system?  How fast was the network?

Well, that was my problem.  I didn't have much equipment to work with which
is why I sent it out to a list like this.  I was hoping that someone else
would be able to do a test on the equipment that they had and verify my
results on different equipment.

I noticed on the ICMP reassembly required timeout that the packets returned
were from IP addresses that were in different parts of the attacks (it
helped that I put random source IP addresses in the file).  It was almost as
if some of the packets I had sent to the Linux box were dropped during the
attack.  But again this could easily be a function of the slow CPU of the
box.

Ken

---------------------------------------------------------------
Do not meddle in the affairs of wizards for they are subtle and
quick to anger.
Ken Hollis - Gandalf The White - gandalf@digital.net - O- TINLC
WWW Page - http://digital.net/~gandalf/
Trace E-Mail forgery - http://digital.net/~gandalf/spamfaq.html
Trolls crossposts - http://digital.net/~gandalf/trollfaq.html



[-- Attachment #2: Rose.rtf --]
[-- Type: application/msword, Size: 91637 bytes --]