7

I asked a question earlier today on serverfault, but found out that there was also a security stack exchange. I had conflicting answers from there. The following is the link:

https://serverfault.com/questions/346609/dos-attack-simulation-vs-real-deal

One person states that there is no difference, whereas another has stated that certain aspects of a DoS attack are very difficult to simulate.

What I'm really curious about is whether real and simulated attacks are equally difficult to mitigate. If so, how?

Improve this question

4 Answers 4

Reset to default
7

The relationship is one-way: the simulated DDoS is similar to a subset of possible DDoS. So if your system is killed by the simulated DDoS, then you have positively proven that the system does not resist well to DDoS in general. On the other hand, if your system keeps on operating while under your simulated attack, then you have not proved resistance against generic DDoS attacks, only resistance against DDoS attacks which match your simulation. It is still a useful test (and quite similar to load testing, as others have pointed out).

The general framework of a DDoS implies that the attacker musters way much more resources than you, under the guise of many distinct genuine network clients. By definition, you cannot, even for testing purposes, muster more resources than what you can muster (duh), so you cannot really simulate a full-fledged DDoS.

Improve this answer
5

I have carried out DDoS tests for clients - to assess their DDoS mitigation strategies. The only difficult parts of it are getting the resources together to provide a high enough load, and ensuring they are distributed widely enough to effectively simulate a real-world attack.

As it is illegal in most parts of the world to tap into a botnet, there aren't many organisations that can provide this sort of load. Some of the larger ISP's can, and some global organisations, but for many kinds of testing you won't need more than 100 or so traffic sources.

  • Saturating your choke router is one level.
  • Saturating the link to your ISP is the most useful level to test.
  • Saturating your ISP entirely - might be possible if you use a small ISP. I haven't tried this but imagine it would be fun.

They are difficult to mitigate - it requires provision of routing planning with your ISP, intelligent traffic assessment and a rapid response time.

Improve this answer
2
  • 1
    Companies like here parabon.com/frontier-products-services-support seem to have large computing resources for providing ddos services. I was not able to see how much it was. Considering the fact that a simple DoS simulation is free, I'm curious as to how much companies value a full throttle ddos attack service from a company who has a huge grid. These grids are pretty much "legal equivalents" of botnets. Could you, by any chance, estimate how much such a service may cost?
    – Harry
    Commented Jan 5, 2012 at 19:24
  • I have seen ones for tens of thousands of pounds - the main cost is usually the personnel requirement, as you typically need standby team members for each portion of the client network affected, as well as the DDoS mitigation network. It should be able to run almost automatically, but for testing you need to be able to analyse every stage in real-time.
    – Rory Alsop ♦
    Commented Jan 6, 2012 at 1:05
2

I think you cannot simulate a true DDoS, because you'd need a lot of resources for your simulator such as bandwith, a very huge machine numbers, and so on. DDoS is not so easy to do as attack because it needs a lot of actors with high bandwith.

It's a scale problem. You can simulate a DoS attack but for a Distributed DoS you must have a lot of resources to use.

Improve this answer
5
  • But if it's possible to conduct load testing with DoS simulation, doesn't that potentially mean that resources are not too much of an issue? My suspicion is that not having huge machine numbers might make it difficult to generate a sufficiently diverse array of IP addresses, because there are ways to distinguish between spoofed ones and genuine ones.
    – Harry
    Commented Jan 5, 2012 at 7:43
  • Yes you are right and this is the reason beacuse I don't believe in DDoS simulation...
    – robob
    Commented Jan 5, 2012 at 9:29
  • 1
    @robob - it's real. It just isn't a simulation. You do DDoS testing by running a DDoS. The bigger the better.
    – Rory Alsop ♦
    Commented Jan 5, 2012 at 15:49
  • @Rory a real DDoS test isn't a test. Same thing for penetration tests...they are penetretion activity.
    – robob
    Commented Jan 5, 2012 at 19:52
  • Yup - totally agree
    – Rory Alsop ♦
    Commented Jan 6, 2012 at 1:02
2

A simulated DDoS attack has merit. Or other way to think about it is that its good to perform load testing on your application. This can provide valuable information such as knowing how many users your application can support.

When it comes to DoS attacks, if an attacker finds that a specific vector isn't effective he will likely change tactics. Its not possible to stop every attack. If the attack is large enough the the routers forwarding traffic to you can be saturated and your server will be unaccessible.

Improve this answer
1
  • Simulation definitely seems to provide value for conducting load testing. But if I were to seek IT security/incidence response drills, then simulation is not very effective. Correct?
    – Harry
    Commented Jan 5, 2012 at 7:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .