1

I installed VM centOS 6.8 then I installed hping3 tools. With this tool, I can take down any PC connection on the network as well as increase CPU and RAM usage with the following command

hping3 --flood -S xxx.xxx.xxx.xxx

I have done a lot of search on Google, and most of the people advise to follow these steps to add/modify the registry

To do that, open Windows registry editor and go to this registry path

HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters

Create "DisableIPSourceRouting" Data Type " REG_DWORD" Set Value To "2"

Create "IPEnableRouter" Data type "REG_DWORD" Set Value "0"

Create "SynAttackProtect" Date type "REG_DWORD" Set type "3"

Create "TcpMaxConnectResponseRetransmissions" Data type "REG_DWORD" Set Value "1"

Create "TcpMaxHalfOpen" Data type "REG_DWORD" Set Value "500"

Create "TcpMaxHalfOpenRetried"  Data type "REG_DWORD" Set Value "400"

But unfortunately even I have added those, I still can do this kind of attack.

More information, I'm using Symantec endpoint security 14, and I have enabled " Enable denial of service detection "

Any assistance would be greatly appreciated

  • Are you fearing external attacks or is this really about what is happening in your local network? – davidb Dec 27 '16 at 16:25
  • It happened on my local network. Do you have any solutions? – Fanar AL HAYALI Dec 28 '16 at 7:28
3

The registry settings that you list are for particular types of mal-formed traffic that can cause DoS. But what you are doing is sending more traffic than the destination can handle. All the packets are properly formed. There is no registry setting to protect against high-volume floods.

To protect something from a flood, you need something in between that can hold the flood back. Like a router.

  • Thanks for the explanation. But those attacks are coming from my internal network, and there isn't a firewall. Do you know a software that could protect my users? As I mentioned before all PC are installed Symantec endpoint security 14 – Fanar AL HAYALI Dec 28 '16 at 7:31
  • That's my whole point. An internal machine flooding and internal machine is very difficult to stop. You need another machine in the middle. This isn't a situation for software to fix, you need a network-level solution. – schroeder Dec 28 '16 at 7:33
0

Maybe a firewall and IDS/IPS will help. It will block the IP throwing high packets to destination i.e. your machine. Or else block ICMP protocol or ping.

  • Any firewall and IDS/IPS software suggestions? – Fanar AL HAYALI Dec 28 '16 at 7:33
0

To guard against DoS/DDoS attacks, configure the maximum number of new sessions and the allowed total number of sessions from a single source (Max. Number of Sessions/Max. Number of Sessions per Source) to protect against resource exhaustion. These settings are also configured on a per-rule basis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.