How to stop a service denial attack before it stops you
BY SHAWN P. MCCARTHY

Itís not easy to defend a federal Web server against distributed service denial attacks, but itís not impossible either.

For years now, the government has been under the gun in an undeclared cyberwar with hackers around the globe. The simplest and so far the most common attack is denial of service, which keeps a server so busy with fake data traffic that it canít do its real job.

A distributed denial-of-service attack pits multiple computers across the Internet against a single target server. Most serious attacks today orchestrate the use of hundreds of machines and take the target server out of commission for the duration of the attack.

Site managers are busy searching for ways to defend themselves. It will take a more centralized effort to make a real difference, plus a commitment from Internet service providers to truly put a lid on the monster.

The first defensive step is understanding how the game is played.

It used to be possible to tell who was sending too much data traffic by examining the data packets. But hackers have taken up IP spoofing, which conceals the address of the originating machine. The Internet, designed to share data openly, is very trusting. Dump a data packet anywhere on the Net, and it will be delivered without prejudice.

Styles of attack

When a server comes under attack, itís important to recognize the style of attack. Sometimes itís a combination of styles. Captus Networks Corp. of Woodland, Calif., has identified four types of attacks as most common:

  • Internet Control Message Protocol flooding. An ICMP ping on a server produces an echo response to confirm the serverís presence. When enough pings are sent, the target server can do nothing but respond to the requests.

  • Smurf attack. It appears to originate from the target serverís own IP address or somewhere on its network. Targeted correctly, it can flood the network with pings and multiple responses.

  • User Datagram Protocol flood. UDP diagnostic services generate characters that are echoed back from the receiving end to the host. This can swamp the network with useless data.

  • TCP SYN flood. Multiple spoofed requests for Transmission Control Protocol connections force the server to keep ports open, waiting for responses.


    These four types of attacks involve incoming traffic. At a higher and more serious level, a target server is compromised and used to attack machines elsewhere. It becomes necessary to monitor the serverís outgoing traffic, too.

    Many agencies have installed two basic defenses:

  • A firewall where the agency LAN connects to an Internet service provider or other network access point. A firewall can keep hackers out, but itís not good at stopping a distributed service denial attack.
    Many firewalls can be configured to act as packet-filtering routers, which means they strip out bad packets and still let legitimate traffic through. But by the time the bad traffic reaches the firewall, itís already clogging the Internet connection.

  • A network-based intrusion detection system. An IDS is generally set to so-called promiscuous mode so it can see all passing data. It can log improper data or trigger an alarm. A host-based IDS is similar, but set to monitor a single service on a host.
    Both types of intrusion detection systems can be configured to look for specific data signatures or anomalies. They donít react directly to the intrusion, but they can trigger separate filtering systems.
    One disadvantage is that they, like PC antivirus software, must constantly be updated with suspect data signatures.


    Firewalls and intrusion detection systems are reactive measures. They wonít stop an attack, and they can shut only part of it down.

    Bad traffic can be shut down at two points:

  • The most effective roadblock is to work with the Internet provider to filter out the flow of bad data, based on analysis of the arriving packets. This is time-consuming but worthwhile because it keeps the network free of unwanted traffic.

  • A quicker but less effective method is to install a traffic-limiting intrusion detection system that looks for unusual or anomalous traffic. It takes advantage of a feature in TCP/IP to confirm whether traffic comes from a nonspoofed source.
    A traffic-limiting IDS can also reframe data communications between two points by asking the sender to slow down the rate of data acknowledgment. Legitimate servers will do so.

    Those that donít are deemed untrustworthy, so their packets are then filtered out.

    This method is mainly effective against what security expert Steve Gibson has dubbed ďscript kiddies,Ē who work within Microsoft Windows and download hacking scripts from the Internet. Such hackers donít know sophisticated methods of concealing their IP addresses.

    In theory, a traffic-limiting device installed outside the firewall should strip out and redirect bad traffic without becoming a choke point for good traffic. It could also deny inbound data from specified IP addresses, either for a set time or until an attack stops.

    The denial automatically ends when traffic flow returns to normal.

    Managers with such systems in place can set thresholds and policies for various triggers, as well as alerts and filters for bad traffic.

    Only provider can bar packets

    But this approach wonít rid the network of unwanted packets. Only the Internet provider can keep them out. Also, itís nearly impossible for the straight traffic-limiting approach to succeed with heavily spoofed packets because each can arrive with a different fake IP address. The best overall bet is a multilevel approach:


  • A filtering and traffic-limiting device at the agency firewall will limit inbound service-denial traffic. If it does egress filtering, it can prevent agency servers from being used in an attack.

  • A similar setup at the highest bandwidth point will do even more. Large government networks have a slight advantage here because they donít have to count on commercial providers to install such devices.

  • Finally, having two or more gateways will make the agencyís network redundant and therefore harder to shut down.

    Incoming! Be alert for four common raid styles

  • Internet Control Message Protocol flooding. Numerous pings overtake a server.

  • Smurf attack. This attack method makes it possible for the offending request to masquerade as queries from a userís own server.

  • User Datagram Protocol flood. UDP diagnostic services create characters that swamp the network with useless data.

  • TCP SYN flood. Multiple spoofed TCP connection requests force the server to keep ports open.

    For those who are interested, here are some links to further information on DOS:
    GRC.com
    Happy Hacker
    Oreillynet
    Opensourcefirewall