A DoS attack occurs when an attacker attempts to flood a resource with data and requests which denies legitimate users access to the resource, or prevents the resource from processing legitimate requests. Regardless of the method, the net effect of DoS attacks is to shut down a server or an application.
Messaging servers survive DoS attacks listed in the table without loss of sanity, without rebooting or restarting, and without reloading, and automatically recover to full service after the DoS attack.
| Attack type | Description |
|---|---|
| SYN flood (TCP SYN) | Phony TCP SYN packets from random IP addresses at a rapid rate fill up the connection queue and deny TCP services to legitimate users. |
| Land | Land attack combines IP spoofing with opening a TCP connection. It sends a request to open a TCP connection (SYN flag in the header is on) but changes the IP address so that both the source and destination IP addresses are the same - the destination host IP address. When the destination host receives the packet, it sets a SYN, ACK to itself because destination and source IP addresses are the same with the same sequence number. The system expects a different sequence number related to the SYN, ACK packet from the other host, so it keeps sending the ACK packet back expecting an updated sequence number. This puts the host into an ACK loop. |
| Smurf / Pong | Large numbers of ICMP echo (PING) messages sent with the forged address of the intended victim, and Layer 2 devices issue an echo reply (pong), multiplying the traffic by the number of responding hosts. |
| Fraggle | Like Smurf, Fraggle is a UDP flood that uses an IP broadcast address of the victim (IP spoofing) that results in an infinite loop of echo and reply messages. |
| Packet replay attack | Packet replay refers to the recording and re-transmission of message packets in the network. Packet replay is a significant threat for programs that require authentication sequences because an intruder could replay legitimate authentication sequence messages to gain access to a system. An attacker replays the same packet at different rates. This replay of the same packet results in the system trying to process duplicate packets that causes the following issues:
|
| PING flood | Because so many ping utilities support ICMP echo requests and an attacker does not need much information. Sending a huge number of PING requests can overload network links. |
| Finger of death | The attacker sends finger requests to a specific computer every minute but never disconnects. Failure to terminate the connection can quickly overload the server’s process tables. The finger listen port number is 79 (see RFC 742). |
| Chargen packet storm | The attacker spoofs the chargen service port 19 between services installed on different computer systems. Spoofing causes the services to go in an infinite processing loop. The infinite loop results in loss of performance or total shutdown of affected network segments. |
| Malformed or oversized packets | Malformed packet attacks cause protocol handlers to cease operation. The protocol handlers fail to process odd formations of a protocol or malformed packets sent as part of a protocol.
Oversized packets place data in an order that the protocol handlers do not recognize or create packets that are larger than the maximum allowed size. |
| SPANK | The target responds to TCP packets sent from a multicast address causing a DoS flood on the target’s network. |
| SNMP PROTOS | Utilizing the Protos SNMP tool to test SNMP code, an attacker can generate thousands of valid SNMP packets with strange and anomalous values that cause error conditions. (See http://www.ee.oulu.fi) |