Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

How do you identify whether a broadcast traffic is normal or is considered an attack such as a DoS attack?, There is some information that the plot or the source that allows me to differentiate between an attack and a normal flow?

share|improve this question
1  
Not sure what you mean by broadcast traffic. If you are considering traffic on the network's last IP address/broadcast IP then it will be only local to network, it will never pass pass the gateway, so it cannot cause DoS on a remote host. – Kapish M Jun 20 '12 at 3:35
The broadcast is also one of the possible ways of disseminating information of any kind into the computer networks. With the broadcast information is broadcast on a node and reaches all the nodes of the network. In a local area network, for example, you can send a message to all members of the same network using a special MAC, which is ethernet FF.FF.FF.FF.FF.FF – Melkhiah66 Jun 20 '12 at 4:06
1  
Sending broadcast packets on the broadcast address is only significant to local network. It will not pass the default gateway, and cannot cause DoS over WAN links and Internet. Local DoS concept is in almost nonexistence. To cause DoS attack on a remote host on the internet via WAN links it has to be an unicast packet. – Kapish M Jun 20 '12 at 4:21
Actually, pre-RFC 2644 routers would forward directed broadcast packets, allowing the delightfully named "Smurf" family of DoS attacks, where you insert a broadcast ping request with the reply address forged to match the target server. – Graham Hill Jun 20 '12 at 16:35
If by "broadcast attack" you mean some shmuck in a conference room who absent-mindedly loops your Ethernet network (and you're not running spanning-tree) and causes a broadcast storm... no, it'll be hard to differentiate, but there will be a lot of it. – Mike Jun 20 '12 at 22:02

1 Answer

up vote 1 down vote

You'll want to capture the packets with a sniffer, such as Wireshark, and look at the payload and source addresses, and see if it is expected traffic.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.