DMCA
An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks (2001)
| Citations: | 192 - 2 self |
BibTeX
@MISC{Paxson01ananalysis,
author = {Vern Paxson},
title = {An Analysis of Using Reflectors for Distributed Denial-of-Service Attacks},
year = {2001}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Attackers can render distributed denial-ofservice attacks more difficult to defend against by bouncing their flooding traffic off of reflectors; that is, by spoofing requests from the victim to a large set of Internet servers that will in turn send their combined replies to the victim. The resulting dilution of locality in the flooding stream complicates the victim's abilities both to isolate the attack traffic in order to block it, and to use traceback techniques for locating the source of streams of packets with spoofed source addresses, such as ITRACE [Be00a], probabilistic packet marking [SWKA00], [SP01], and SPIE [S+01]. We discuss a number of possible defenses against reflector attacks, finding that most prove impractical, and then assess the degree to which different forms of reflector traffic will have characteristic signatures that the victim can use to identify and filter out the attack traffic. Our analysis indicates that three types of reflectors pose particularly significant threats: DNS and Gnutella servers, and TCP-based servers (particularly Web servers) running on TCP implementations that suffer from predictable initial sequence numbers. We argue in conclusion in support of "reverse ITRACE" [Ba00] and for the utility of packet traceback techniques that work even for low volume flows, such as SPIE.
Keyphrases
distributed denial-of-service attack attack traffic characteristic signature flooding stream predictable initial sequence number traceback technique flooding traffic probabilistic packet significant threat spoofed source address reverse itrace ba00 denial-ofservice attack internet server itrace be00a combined reply gnutella server reflector attack web server tcp implementation large set different form possible defense low volume flow reflector traffic packet traceback technique tcp-based server
