analysisofadenialofserviceattackontcp-全文預(yù)覽
【正文】 sion 10/17 Solution (5/5) ? Firewall approach (cont’d) ? Firewall as a semitransparent gateway ? Drawback ? Waste a large number of illegitimate open connections at the destination if it is under attack Li A D Firewall SYN SYN+ACK ACK RST Timeout Li A D Firewall SYN SYN+ACK ACK ACK Data Data Fig 5. Attacker scenario Fig 6. Legitimate connection 11/17 Synkill (1/2) ? Active monitor ? Active : generate TCP packets and inject them into the work ? Monitor : read and examine all TCP packets on the LAN ? Algorithm ? TCP packet processing ? Source IP address prefiltering ? Decision process based on events ? Observed TCP packets ? Timer events ? Administrative mands ? Classification of source IP address ? Based on observed work traffic and administratively supplied input ? null, good, new, bad ? perfect, evil 12/17 Synkill (2/2) ? Algorithm (cont’d) ? Actions ? Send RST packet for bad or evil state ? Generate ACK packet Fig 7. Attack scenario SYN A Synkill D LISTEN SYN+ACK RST SYN_RECVD CLOSED Resource release A Synkill D LISTEN SYN SYN+ACK SYN_RECVD ACK CONNETED ACK Fig 8. Normal access scenario A Synki l D LISTEN SYN SYN+ACK SYN_RECVD ACK RST Expiry CONNETED CLOSED
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號-1