0

Is it possible (and how) to tell from a network dump if there is a buffer overflow attack, DoS or brute force attack? A DDoS would be more obvious to identify, but those attacks mentioned above I think would look a little more like normal activity.

Sorry for my newbie question, your answer would help a lot. Any information on how to identify these attacks from network dumps would be extremely appreciated.

1

It would depend on a number of factors, such as what protocol was used.

Let's assume for the sake of the answer that the protocol in question is unencrypted HTTP.

Buffer Overflow.

This would be the trickiest of the 3 to identify, as it could just look like a large request. It's possible that you could identify it from some common patterns that people use in Buffer Overflows (e.g. a series of 'A' characters) but that's not a requirement of the attack so in many cases it could be hard to detect, depending on how similar it looks to a standard request to the application

DoS.

This should be relatively easy to spot from a Network dump. You would likely see a large number of requests to the service either SYN packets (for a standard SYN flood attack) or perhaps a specific application request (like a search) for an application DoS, it would likely be visible as the volume of traffic to the service would go up quickly.

Brute Force.

In most cases this would be quite easy to pick out from a network dump as you'd see a large number of unsuccessful logins to the application either coming from one IP address or a range (depending on whether the attack was distributed or not). This would likely stand-out from ordinary traffic patterns, so be relatively easy to spot.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.