2
votes
5answers
922 views

SYN flooding attack causing high CPU on hardware firewall

I have a ZyWall USG 200 firewall. A few days ago there was a SYN flooding attack on it causing 100% CPU load. After investigating it turns out this was attack from a single IP address and while the ...
2
votes
1answer
2k views

Snort/IDS detect and alert on possible DoS/DDoS attack?

As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack. Looking at the rulesets, which are primarily signature based rules, I can't see a ...
-4
votes
1answer
1k views

DoSing my Home Network with only a Public IP address [closed]

+--------------------------------------------------------+ | Client Host Name |.. IP Address ..|.... MAC Address ...| | Desktop-Home ....| 192.168.1.100 | 00:19:D1:EA:03:68 | | GT-S5380K ...
2
votes
2answers
559 views

Does “loose source and record route” drop the source address?

Is the source IPv4 address lost when a person uses "loose source and record route" and the destination address is put before the end of the list of addresses through which routing should occur? It ...
8
votes
1answer
12k views

TCP Peer unexpectedly shrunk window messages in dmesg log

We get quite few messages like these in our dmesg log on various servers: TCP: Peer 0000:0000:0000:0000:0000:ffff:d431:5861:56369/80 unexpectedly shrunk window 2522304441:2522312601 (repaired) TCP: ...
6
votes
1answer
178 views

Parabolic Denial Of Service — Would it work?

Would this DoS attack be effective: Attacker determines target (10.0.0.1) Attacker sends ack packets to a buch of web servers with a src addr of 10.0.0.1 Servers reply to 10.0.0.1 with syn packets ...
4
votes
3answers
2k views

How to protect myself against paid DDoS services?

I am domestic user and I am getting attacked regularly by a guy that hates me. Here is the background story: that guy uses Skype resolvers (tools offered by paid DDoS services) to find out my IP ...
9
votes
1answer
765 views

Best way to report a foreigner attacker's ip to authorities?

I have been under attack last week and I was able to trace down the attacker and get his IP address. The attacker was located in Germany but I live out of Europe? From your experience what is the ...
0
votes
3answers
399 views

Is it possible to “close” a port by dos'ing it?

If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
4
votes
4answers
3k views

Using SYN cookies to perform a DOS attack

In my software security class, we had this question: You are the system administrator for a provider that owns a large network (e.g., at least 64,000 IP addresses). Show how you can use SYN ...
3
votes
1answer
262 views

Could somebody explain connect loop DoS?

I'm trying to understand this vulnerability. How can I reproduce this?
2
votes
1answer
1k views

How do I protect my Windows computer against the IPV6 flood attack shown in this video

In the DefCon video "Three Generations of DoS Attacks (with Audience Participation, as Victims)", the speaker demonstrates how it is possible to crash a variety of devices by flooding them with IPV6 ...
2
votes
1answer
168 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
6
votes
4answers
1k views

Is this type of ARP poisoning attack possible?

I am wondering if it is possible to paralyze a network by sending out a bunch of fake ARP response packets. Some basis: I recently read a moderately detailed description of how ARP and ARP poisoning ...
22
votes
3answers
3k views

How do DoS/DDoS work?

In the last days one could frequently read about attacks from anonymous and LulzSec against different platforms like Sony or HBGary etc. Yesterday for example they DDoS'ed soca.gov.uk and jhw.gov.cn. ...