User's Manual

383
Users Manual of CS-6306R
Chapter 41. DoS Attack Prevention Configuration
DoS Attack Prevention Configuration 41.1
41.1.1 DoS Attack Overview
41.1.1.1 Concept of DoS Attack
The DoS attack is also called the service rejection attack. Common DoS attacks include network bandwidth
attacks and connectivity attacks. DoS attack is a frequent network attack mode triggered by hackers. Its
ultimate purpose is to break down networks to stop providing legal users with normal network services.
DoS attack prevention requires a switch to provide many attack prevention methods to stop such attacks as
Pingflood, SYNflood, Landattack, Teardrop, and illegal-flags-contained TCP. When a switch is under attack, it
needs to judge which attack type it is and handles these attack packets specially, for example, sending them
to CPU and drop them.
41.1.1.2 DoS Attack Type
Hackers will make different types of DoS attack packets to attack the servers. The following are common DoS
attack packets:
41.1.1.3 Ping of Death
Ping of Death is the abnormal Ping packet, which claims its size exceeds the ICMP threshold and causes the
breakdown of the TCP/IP stack and finally the breakdown of the receiving host.
41.1.1.4 TearDrop
TearDrop uses the information, which is contained in the packet header in the trusted IP fragment in the
TCP/IP stack, to realize the attack. IP fragment contains the information that indicates which part of the
original packet is contained, and some TCP/IP stacks will break down when they receive the fake fragment
that contains the overlapping offset.
41.1.1.5 SYN Flood
A standard TCP connection needs to experience three hand-shake processes. A client sends the SYN
message to a server, the server returns the SYN-ACK message, and the client sends the ACK message to the
server after receiving the SYN-ACK message. In this way, a TCP connection is established. SYN flood
triggers the DoS attack when the TCP protocol stack initializes the hand-shake procedure between two hosts.
41.1.1.6 Land Attack
The attacker makes a special SYN message (the source address and the destination address are the same
service address). The SYN message causes the server to send the SYN-ACK message to the sever itself,
hence this address also sends the ACK message and creates a null link. Each of this kinds of links will keep
until the timeout time, so the server will break down. Landattack can be classified into IPland and MACland.