Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have seen numerous research papers that claim it is "easy to detect network layer DDoS attacks" without saying why. Usually these research papers focus on detection or prevention of application layer attacks, which is why they don't go into detail about network layer attacks. Why is it easy to detect network layer attacks? One of the papers I am looking at says "In network-layer DDoS attacks, attackers send a large number of bogus packets (packets with bogus payload and invalid SYN and ACK number)". Why not just open up a large number of "new connections" with valid data, other than a spoofed IP address? Yes, I suppose it would be easy to detect when you've just received a packet with an invalid packet header. But what about when you receive a lot of packets with valid headers, that are nonetheless from spoofed IPs?

share|improve this question
1  
Have you ever sat at a computer that was being DoS'd? With wireshark or tcpdump open? It is almost impossible not to notice. Packets fly across your screen faster than you can read what they are. Detecting these kinds of things are no problem. –  Rell3oT Mar 10 '13 at 7:08

3 Answers 3

Network-layer DDoS attacks typically involve a lot of very similar traffic; it follows a discernable pattern, it appears in statistically unusual quantities, and it looks very different from the surrounding "normal" traffic.

That's what makes it easy to identify.

share|improve this answer
    
But what about when you receive a lot of packets with valid headers, that are nonetheless from spoofed IPs? You can't drop those packets without potentially dropping legitimate users connections –  KyleM Mar 10 '13 at 7:59
    
If it followed a discernable pattern, it would be easy to block (without blocking legitimate traffic) also. –  ruief Mar 10 '13 at 18:02

The traffic tends to look very different, depending on the protocol being used. SYN floods, for example, are distinguished by a large increase in the number of two-packet sessions, representing one SYN from the attacker, and one SYN-ACK from the victim. If you're monitoring your connections, and you see a large increase in both volume and source IP diversity, you can be pretty sure you're under DDOS attack.

It is important to distinguish between "easy to detect" and "easy to distinguish" however -- knowing "I'm under DDOS attack" doesn't help you figure out which individual sessions are malicious and which aren't. You have to look at each individual session, and sometimes the sessions look normal but are just truncated.

Yes, I suppose it would be easy to detect when you've just received a packet with an invalid packet header. But what about when you receive a lot of packets with valid headers, that are nonetheless from spoofed IPs?

This is "Tackling Application-layer DDoS Attacks" by Hakem Beitollahi and Geert Deconinck, yes? I think that what the authors are doing is using valid vs. invalid headers as a way of distinguishing types of attack. They seem to be defining attacks using packets with valid headers as application layer attacks, and invalid-header packets as network layer attacks. So, they're not necessarily claiming that one is done more often than the other, or more effective than the other: they're just defining a smaller problem that they then address with their ConnectionScore system.

share|improve this answer

Why DDos attacks are easy to detect?

Because its in the nature of the attack; it doesn't hide itself it is no way a stealth attack its not like great white shark attacking you; its more of situation where you are being hit by huge ice-berg.

Why spoofing IP is hard?

Now, for technical bits, Spoofing an IPS addresses wouldn't get you far because like in cisco asa 5885 with bultin in AIP module it works in-line but on LAYER-2 meaning all the traffic goes by un-detected. Even its not picked by traceroute packet. This feature is for the reasons you just suggested in your last lines; its IPS defense mechanism.

Also, it is recommended that the IPS is placed behind the firewall not infront of it; as placing it in front causes it receives un-wanted traffic overwhelming its signature engine,It make sense that IPS only do analysis on authorized / allowed traffic. So IPS in that case would be hidden automatically by firewall.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.