Tagged Questions
1
vote
1answer
193 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
-4
votes
1answer
191 views
DoSing my Home Network with only a Public IP address [closed]
+--------------------------------------------------------+
| Client Host Name |.. IP Address ..|.... MAC Address ...|
| Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 |
| GT-S5380K ...
2
votes
2answers
100 views
Does “loose source and record route” drop the source address?
Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur?
It ...
5
votes
1answer
4k views
TCP Peer unexpectedly shrunk window messages in dmesg log
We get quite few messages like these in our dmesg log on various servers.
TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired)
TCP: ...
5
votes
1answer
160 views
Parabolic Denial Of Service — Would it work?
Would this DoS attack be effective:
Attacker determines target (10.0.0.1)
Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1
Servers reply to 10.0.0.1 with syn packets
...
4
votes
3answers
1k views
How to protect myself against paid DDoS services?
I am domestic user and I am getting attacked regularly by a guy that hates me.
Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
9
votes
1answer
332 views
Best way to report a foreigner attacker's ip to authorities?
I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe?
From your experience what is the ...
0
votes
3answers
277 views
Is it possible to “close” a port by dos'ing it?
If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
4
votes
4answers
1k views
Using SYN cookies to perform a DOS attack
In my software security class, we had this question:
You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
3
votes
1answer
211 views
Could somebody explain connect loop DoS?
I'm trying to understand this vulnerability.
How can I reproduce this?
2
votes
1answer
535 views
How do I protect my Windows computer against the IPV6 flood attack shown in this video
In the DefCon video "Three Generations of DoS Attacks (with Audience Participation, as Victims)", the speaker demonstrates how it is possible to crash a variety of devices by flooding them with IPV6 ...
2
votes
1answer
121 views
Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)
My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model.
After reading Qualys's blog regarding slow TCP reading, I ...
5
votes
4answers
719 views
Is this type of ARP poisoning attack possible?
I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets.
Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
19
votes
3answers
2k views
How do DoS/DDoS work?
In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...
