I am trying to understand and simulate SYN Flood DDOS attacks. I am using snort to give me alerts. While I have control over the rate for my testing, I am interested in knowing what a good estimate of the traffic rate might be for an actual attack?
-
12 nodes sending syn floods is technically an "attack". The thing that matters is if it has an effect. That measure is up to the bandwidth you can handle.– schroeder ♦Commented Nov 1, 2018 at 21:51
Add a comment
|
3 Answers
Nowadays TCP SYN attacks are not common, focus more on UDP amplification attacks over DNS, memcache and other UDP services. On the other hand, if you want to compute the traffic rate you can use the formula, IP header (20 bytes) + TCP header (20/32) bytes per packet, so is easy to know how many packets per second you need to send if you want a 1GB for example.
Another key aspect that you may consider is the "IP address spooofing", in order to avoid the detection of the source of the attack is easy spoof IP/UDP packets than IP/TCP if you want full TCP connection.
I don't think there's an absolute answer here.
A number of DDoS detection appliances and applications operate this way: You do a baseline measurement in bits/sec and packets/sec to determine what normal levels are for your setup and how much those levels fluctuate. Ideally, you make this baseline over a longer period of time to account for day/night and weekday/weekend patterns. Then, you can chose a level above which you decide that traffic patterns are suspicious.
Another approach could be to test various levels of packets/sec of SYNS to determine at what level your network, application or whatever it is you're trying to protect is suffering, then you chose a level which is safely below this amount of packets/sec.
I believe the average rate these days (Nov 2018) is on the order of 3 Gbps (though large scale attacks can easily go up to 100 Gbps). One note, TCP SYN floods are a fairly uncommon vector these days. UDP floods are much more common.
answered Nov 1, 2018 at 19:59
