On the other hand, although details of denial-of-service attacks are well-known and studied, it is quite difficult to protect any systems from it due to the very nature of the attacks. Scanning tools and other intrusion detection systems can be used to detect attacks or find vulnerable spots which can lead to an DoS attack.

On the other hand, although details of denial-of-service attacks are well-known and studied, it is quite difficult to protect any systems from it due to the very nature of the attacks. Scanning tools and other intrusion detection systems can be used to detect attacks or find vulnerable spots which can lead to an DoS attack.

In October 2002, an attacker tried to performed a DDoS attack on the complete set of DNS root servers which have 13 servers of replicated DNS data in total. By a simple form of DDoS attack, he successfully took down 9 of them. The other 4 remained fully functional. The attack lasted only one hour. A longer and stronger attack might have been extremely harmful.

On February 6th, 2000, Yahoo portal was shut down for 3 hours. Then retailer Buy.com Inc. (BUYX) was hit the next day, hours after going public. By that evening, eBay (EBAY), Amazon.com (AMZN), and CNN (TWX) had gone dark. And in the morning, the mayhem continued with online broker E*Trade (EGRP) and others having traffic to their sites virtually choked off. (Business Week Online, 12 February 2000)

==Types of attack==

==Types of attack==

There are many ways to conduct a DoS attack. Some of them are

There are basically three types of DoS attack:

* Sending oversized packets

# Bandwidth attacks: straight forward, comsume resources.

* fragmentation overlap

# Protocol attacks: take advantage of expected behavior of protocols such as TCP, UDP and ICMP.

* loopback floods

* Application DoS

There are many tools for each type such as:

* UDP floods

* Sending oversized packets (protocol)

* SYN floods

* fragmentation overlap (protocol)

* loopback floods (protocol)

* Application DoS (software)

* UDP floods (protocol)

* SYN floods (bandwidth)

==Tools for conducting DoS attacks==

==Tools for conducting DoS attacks==

===SSPing===

===SSPing===

[[Image:SmurfAttack.gif|thumb|right|100px|Smurf]]

[[Image:SmurfAttack.gif|thumb|right|300px|Smurf]]

[[Image:SYN_flood.jpg|thumb|right|100px|SYN Flood]]

[[Image:SYN_flood.jpg|thumb|right|300px|SYN Flood]]

SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented, oversized ICMP data packets. While trying to put the fragments together, the computer can get into a memory overflow which causes the machine to freeze. SSPing affects Windows 95/NT and Mac OS.

SSPing, a DoS tool, is a program sends the victim's computer a series of highly fragmented,  

 

over-sized ICMP data packets. While trying to put the fragments together, the computer can  

Jolt is a program known for this kind of attack. It will freeze un-patched Windows 95, NT machines by sending a series of spoofed & highly fragmented ICMP packets to the target, which then tries to reassemble the received fragments.

get into a memory overflow which causes the machine to freeze. With a few packets, the

unknown since the connection is lost as the victim restarts the computer. SSPing affects  

Windows 95/NT and Mac OS.

Jolt is a program known for this kind of attack. It will freeze unpatched Windows 95, NT  

machines by sending a series of spoofed & highly fragmented ICMP packets to the target,  

which then tries to reassemble the received fragments.

===Land Exploit===

===Land Exploit===

Land Exploit is a DoS attack in which a program sends a TCP SYN packet where the target and source addresses are the same and port numbers are the same.

Land Exploit is a DoS attack in which a program sends a TCP SYN packet where the target and  

This trick works for Windows 95 and Windows NT. The computer which is running one of these operating systems will operate slowly and sometimes hang.

source addresses are the same and port numbers are the same. Receiving such packet causes

possible to implement this attack: land.c. Computers running Windows 95 and NT are desired targets of this kind of attack.

===Smurf===

===Smurf===

Smurf is a simple effective DoS attack involving forged ICMP packets sent to a broadcast address. Attackers spoof the source address on ICMP echo requests and sending them to an IP broadcast address. This causes every machine on the broadcast network to receive the reply and respond back to the source address that was forged by the attacker. This attack results in DoS due to high network traffic which not only hurts the victim but the broadcase network also.

Smurf is a simple effective DoS attack involving forged ICMP packets sent to a broadcast  

address. Attackers spoof the source address on ICMP echo requests and sending them to an IP  

broadcast address. This causes every machine on the broadcast network to receive the reply  

and respond back to the source address that was forged by the attacker. This attack results  

in DoS due to high network traffic which not only hurts the victim but the broadcast

network also.

There is a similar tool called Fraggle which uses UDP packets instead.

There is a similar tool called Fraggle which uses UDP packets instead.

===SYN Flood===

===SYN Flood===