Questions tagged [flooding]

The flooding attack is used to overwhelm the server in some way for example using TCP SYN packets which reserves resources on the server for the connection or complete HTTP requests as executed by a bot net. It is closely related to DoS and DDoS attacks. Questions may be about preventing, detecting or even running (for testing purposes) such an attack.

Filter by
Sorted by
Tagged with
0
votes
1answer
65 views

Is it possible to DDos a http wan filterd router? [closed]

Like the service is there but it's just filterd enabled for lan access only .. what will happen ?
0
votes
0answers
63 views

Can jumping to a new SSID be a solution for flood attacks?

If an attacker can access inside my network in any way and make a UDP or ICMP flood attack on any point of the network (server, client or router), can I prevent this attack transiently with jumping on ...
24
votes
3answers
4k views

What is the purpose of using random IP addresses in SYN Flood Attack?

What is the purpose of using random IP addresses in SYN Flood Attack?
0
votes
1answer
182 views

Are NTP servers without monlist still dangerous?

I've been studying DOS flood attacks, namely NTP and DNS floods. I know that monlist is the primary factor in launching these sorts of attacks, but I have one question. The problem is are these ...
1
vote
2answers
182 views

packets characteristics (src,dst ports) of a DDos amplification attacks

In a DDoS amplification attack, say NTP flooding, an attacker uses a botnet network in order to query multiple NTP servers on port 123, spoofing the source address using the address of the victim/...
-2
votes
2answers
2k views

Hping3 doesn't work?

I was trying to perform a SYN flood attack, and I was using hping3. This is how the command looks like : sudo hping3 -S -a 192.168.100.88 --flood -p 80 192.168.100.15 Where 192.168.100.88 is a non-...
-2
votes
2answers
327 views

SYN-flood to the localhost Apache server

I've set up the apache server on localhost (127.0.0.1). I've downloaded PackETH to perform a DoS attack. So PackETH wants MAC-HEADER of the destination and source. And I don't know, where to find ...
-1
votes
2answers
367 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
1answer
230 views

DNS flood vs DNS Amplification attack: How is one considered a network/transport layer attack and the other a application layer attack?

I am reading a survey on DDoS attacks and they describe how these attacks can be classified by either Network/Transport level attacks and Application level attacks. In their examples, they classify ...
2
votes
1answer
541 views

Question about ipsec prevent SYN flooding attack

how IPSec prevents SYN flooding attacks Like if A is sending packets to B using IPsec. Suppose B’s TCP ack gets lost, and A’s TCP retransmits the packet since it assumes the packet was lost. Will B’s ...
3
votes
2answers
582 views

UDP flood 300 Kbps + SYN probes / other attacks. Flood or DDoS at low rate?

So for over 2 weeks, Im receiving what appears a combination of attacks non-stop 24/7. First this UDP flood at a strangely small rate of 280 Kbps / 110 pps (360 bytes length) 02:29:41.978484 IP (tos ...
1
vote
0answers
83 views

Spoofing an IP/MAC address to avoid ICMP Destination Unreachable being sent back [duplicate]

As far as I understand UDP flooding the idea is to send UDP packets across all ports from e.g. Alice to Bob, and get Bob's machine to check who listens to certain ports and generate many ICMP ...
0
votes
1answer
109 views

Mitigate DDoS attacks by randomly blocking traffic during the period of detection process

I'm currently working on a project that builds a defense system against HTTP GET Flooding attacks. When DDoS attacks occur, traffic volume to a server suddenly increases to be far more than the ...
15
votes
4answers
4k views

How to deal with this denial of service attack on an Apache server?

I was the target of different attacks today. The last one created this traffic on port 80. Apache is down and the load on server remains high. Firewall is enabled. Any suggestions? 15:27:10.203993 ...
1
vote
1answer
693 views

Elastix Asterisk CLI flooded with chan_sip.c / sip_xmit warnings

I'm still new to Asterisk/Elastix and apologize if this question is misplaced. Recently one of our larger clients was hacked and we remedied the situation by enabling fail2ban. It seemed to have ...
1
vote
2answers
231 views

How to stop the flood of spam?

I have a website on MS Azure and for the past two months, I've been getting mass amount of requests from Russia spamming my site and logs with non-sense and pro-Trump garbage. Based on what I read, I'...
2
votes
1answer
484 views

Why MSS is needed in SYN cookies?

I was reading RFC4987 describing SYN cookies and seems Maximum Segment Size (MSS) is encoded in the SYN cookie and I am not sure why that is the case? Can someone explain why we need the MSS in the ...
2
votes
2answers
375 views

Hping and spoofed DDoS (or DoS?) what do -U and -P mean?

Recently I set up 2 virtual machines with Mint 18 inside, to practice and analyze some DDoS attack types. For now on, I'm using hping3 to perform some simple DDoS (or I should say, DoS attacks, since ...
1
vote
2answers
2k views

Is port in UDP flood necessary? HTTP flood-down because? UDP, SYN and ICMP flood methods

I have questions about DDoS attacks. In flood scripts, the script sends UDP packets to "ip.address:random.port" Why It doesn't use only the IP? Is port necessary? If someone is HTTP flooding a ...
13
votes
3answers
3k views

What prevents me from launching an SYN-ACK flood using HTTP servers?

I've been studying networks lately and this issue came across my mind. What prevents me from sending a lot of SYN requests with source address of my (attack's) target and flooding the target's ...
1
vote
0answers
688 views

UDP flood from my own IP

A few moments ago I was trying to open Youtube when the browser (Chrome) notified me that I have no internet connection. All of my cable connections were OK. I disconnected the cable from my computer ...
1
vote
1answer
173 views

How do these techniques work for protecting against SYN flood?

I'm reading about how SYN flood can be prevented. Wikipedia has Filtering Increasing Backlog Reducing SYN-RECEIVED Timer Recycling the Oldest Half-Open TCP SYN Cache SYN cookies Hybrid Approaches ...
0
votes
3answers
369 views

Why can't the Router devices worldwide block automatically malicious packets?

Maybe I am wrong but Routers should be able to see if requests are doing many attempt of connection on same port (Brute Force/DDoS) if requests are targeting all ports of a computer (port scanning) ...
5
votes
1answer
1k views

Mac overflow (flooding)

On a recent switch, is mac flooding still a vulnerability to be careful of? If that attack is patched on most of them, then on which type of switch is it still vulnerable?
3
votes
3answers
7k views

TCP versus UDP resilience to DDoS

I am building a service that I can implement equally well with either TCP or UDP. If I use TCP, I expose vulnerability to SYN flood and other attacks on TCP protocol. If I use UDP, it will be harder ...
-3
votes
1answer
198 views

Random scanning or potential attack/recon? [duplicate]

If the purpose of a SYN Flood attack would be to make the target unresponsive to normal traffic, same as any other DoS, wouldn't this attack generally have been directed at a public server rather than ...
0
votes
1answer
41 views

Is there some kind of a local DoS against processes?

Is there an attack that somehow floods a target process (e.g. by repeatedly calling a WinAPI function that involves the process) and thereby crashes or temporarily disables it?
1
vote
1answer
12k views

Router detecting constant ack flood attacks and port scans

I first noticed this yesterday in my logs - while I was configuring the router settings, so I don't know how long it's been going on. What should I do? I reconfigured my router with more secure ...
7
votes
2answers
173 views

Why do ISPs allow faked source IP addresses?

Ok so apparently you can specify a source IP when doing a SYN request or something. Besides just asking why in the world that would even be allowed, I will move past that because I want to understand ...
3
votes
4answers
502 views

Mitigate resend confimartion email flooding

While writing server code for resend confirmation page something came to my mind: an attacker could make several requests to /resendemail?user=blah (example URL) and flood such user with registration ...
9
votes
1answer
3k views

Cisco ASA SYN flood detection and response not working

I have a Cisco ASA 5510 (ASA Version 8.3(2)) that has been getting a syn flood attack on it (or more accurately through it - targeting a host behind it) a couple of times a day for the past few days. ...
3
votes
2answers
162 views

Isn't the behaviour of the switch to flood packets when it's MAC table is still empty dangerous?

If we have a switch with empty MAC table, and three hosts are connected to it - let's say host A, host B, and host C. Host A sends something to host B, and switch remember on which port is host A, but ...
12
votes
6answers
68k views

Google: “Unusual traffic from your computer network”

I often happen to receive the message: "Unusual traffic from your computer network" while googling in Russian speaking countries. Google explains this with: You may see "Our systems have ...
1
vote
1answer
115 views

DOS attack to increase packets received from a single request?

Is there any attack out there that can be implemented where a single request to a server i host for example responds by sending the same file say 20 times back ? the idea behind the attack is to DOS ...
0
votes
2answers
3k views

What could be the reason for the high traffic on the local network? [closed]

In our small company we have very high traffic outbound from local network to server which is getting blocked, and slow downs our server respond time. Especially at night. I am not security ...
2
votes
2answers
320 views

How to create an anti-flood mechanism without leaving VPN's out?

I'm trying to protect my applications from some bots that are either malfunctioning or trying to take my sites down (lots of requests from the same IPs in the logs). Every time someone requests an ...
1
vote
2answers
4k views

Asynchronous vs. Synchronous authentication process

I'm currently developing a web application using Node.js (server-side JavaScript) and MongoDB (NoSQL database). I'm at the stage where I have to design the authentication and I had a question about ...
7
votes
3answers
48k views

Stopping DDOS TCP SYN and UDP flood attacks

I would like to know if it's possible to stop a TCP SYN OR ICMP Flood attacks if these attacks are detected at time. What is the most accurate process to filter these addresses if the only way is to ...
2
votes
1answer
1k views

COMMUNITY SIP TCP/IP message flooding directed to SIP proxy

I have installed Snort IDS and most alarm is: "COMMUNITY SIP TCP/IP message flooding directed to SIP proxy" And i use home DSL Internet connection , should i be worried about this alarm ? I have ...
3
votes
1answer
10k views

how does a sip flood attack work?

I understand that SIP is an application-level protocol that is used to setup/modify/end communication sessions for things like VOIP and instant messenger. I also understand that users can send request ...
0
votes
3answers
2k views

Is there such a thing as MySQL connection flooding?

I'm a developer for a small website. There are 3 webservers (for load balancing) and a MySQL server. Today the webservers seem to be down, and, unfortunately, I cannot get hold of the admin (he's in ...
2
votes
2answers
4k views

How to defend against HTTP request flood

What is the best way to defend your website against HTTP flood POST/GET attacks?
-1
votes
4answers
28k views

Tools for performing HTTP FLOOD attack? [closed]

I'm looking for tools which can perform HTTP FLOOD ATTACK . I seached a lot and this is the only tool I've found DoSHTTP. Does anyone know another tool? I want to test them on my localhost to find ...
2
votes
3answers
2k views

Disadvantages of HTTP GET/POST Flooding Attack?

I asked about What is HTTP GET/POST Flooding Attack? recently and I got a few detailed answers about what they are and how they work. Now I want to find out what are the disadvantages of them.
10
votes
3answers
40k views

What are HTTP GET/POST flood attacks?

I want to know what the main differences are between HTTP GET and POST flood attacks and mitigation strategies for both. I searched a lot but I really can't find some good articles nor examples about ...
5
votes
1answer
1k views

Creating a DDoS attack using DirectConnect

I have been trying to hack around with Apex DirectConnect. What I wish to do is to utilize the querying nature of P2P apps like DC to generate a DDoS attack (see links for reference here, here and ...
0
votes
3answers
740 views

Is it possible to “close” a port by dos'ing it?

If I see port 25 is open, but I dont have access to the program running the smtp server, could It be flooded with enough information to make it unusable (but not affect any other services)?
0
votes
1answer
2k views

Monitor incoming TCP/UDP flood attack and graph it

I'm preparing a presentation on a security issue and want to include a demonstration. It won't be in real time, I just need to show some pictures of the results. I have some VPSes that will perform a ...
6
votes
5answers
3k views

SYN Flooding issue

I recently purchased a server with "DDoS protection" and a 1gbps uplink. What I can't figure out, is that I'm suffering from SYN floods. Isn't the large amount of bandwidth available to me supposed ...
15
votes
5answers
6k views

Risks with Amazon S3 and costs

I have little security knowledge and looking at image hosting for a startup: Considering S3 doesn't allow you to set a cap on costs, how likely is it that someone could flood S3 with requests for my ...