Printable View
Hello All-
Here's some background info before I ask my question: Over the past several months, my internet disconnects randomly. It could be twice a day, or as much as 8 times a day.
So here's my question: if someone is using a Denial Of Service attack on my machine, how can I identify or see if someone it attacking my machine and how can I block them without buying any software?
*Thanks A Ton Guys* :)
-BorgCubes
What is a DoS attack?
What type of DoS attack hit Yahoo! and others?
What is a distributed packet flood?
How can I secure my system against a DoS attack?
And for prevention:
All the answers to these wuestions you can get here... :)
http://petertodd.ca/articles/dos_attacks.php
also a good site on DoS attacks .....
http://www.cymru.com/Documents/dos-and-vip.html
DoS are hard to trace.
Well you could try using something like BlackIce to see if it raises an alert. if you don`t want to shell out for that netstat might help, you can see if there are a large number of connections coming from one address ( may indicate some DoS attacks). You could also try firing up a packet sniffer and seeing what you get.
Lets not jump to conclusions so quickly : :D It might not be a Dos attack. You said that it happens quite frequently. One question that is important to ask is do you have a static IP (one that remains the same) or a dynamic IP (DHCP, one that changes everytime you connect to the internet or any other program requiring a connection.) If you have a dynamic IP, then obviously no one is preforming a Dos attack on your because they simply dont know your IP everytime you log on. Maybe your browser wasnt installed correctly in the first place. Anyways, go back and reinstall your browers, thats what i would do after checking to see if i have a static or dynamic ipQuote:
Originally posted here by borgcubes
Over the past several months, my internet disconnects randomly. It could be twice a day, or as much as 8 times a day.
white_eskimo, that is not true at all, just because a computer uses DHCP doesnt mean that it changes everytime you connect, your thinking of dial-up, and even if a computer uses DHCP there are many ways that a attacker can find you IP, i.e. zone transfers, DIG, ARIN, to just name a few of the ways, not to mention if you have a trojan installed many of them can e-mail or notify the attacker of the address change, but borg cube memory gave you some very nice sites to look at, i didnt look at them all the way through, but my suggestion would be read those, see if you cant figure out on your own what to do, if you are running a linux distro just use IPtables to block any unwanted packets from a IP addy, and if using windows then you will have to use a firewall such as outpost or zonealarm to block certain unwanted traffic, there are many steps you can take to prevent a DoS but unforunatley it is with any other attack, there is always a way around it. take it easy people.
I full agree with hatebreed2000, to the best of my knowledge everything he has just said is correct.
This may be a bit overboard, but you mind as well read a little about DOS attacks. DOS Whitepaper.
hatebreed is right - you don't have to have a static IP to be victim of a DOS, or even used in one for that matter. Some DDOS attacks are initiated via IRC. With that in mind, someone may have infected the victim with an IRC trojan that automatically joins a certain channel whenever connected to the Internet. From there, the attacker can issue commands to execute script/code to perform an attack. I should know; I was infected...haha :(
Was the question: how to make sure I'm being dosed?
There is a single manner: have a look on inbound flows.
You can do that thanx to several methods:
- Protocol analyzer such a EtheReal but u'll need to have good networking skills
- A firewall well configured with logs, (but if it is so well configured, u won't be dosed anymore...)
- an IDS is definitly the best, theree are daily signature update. And it will do everything for u (since the DoS attack is well known to the siganture database), by logging a beautiful message like "DOS - SYN FLOOD" or whatever ...
No, actually DoSes are very easy to trace, unless the attacker does it behind a proxy.Quote:
DDoSes are hard to trace becouse they come from trojaned computers. The trojaned computers make up a botnet.
In order to analayze it, you would need a sniffer or protocol analyzer to take a look at the traffic destined for the machine as already mentioned by Networker. Your degree of understanding of networking will probably determine what tool you use. Ethereal uses a GUI for you to interact with. Also, there are tools like tcpdump/windump and snort - which is also an Open Source IDS that could help you to pick up and identify attacks like these (if it was an attack, of course) more efficiently. There are also a few personal firewalls that pick up and block the attacks. I think that BlackICE does this.
If you think you are experiencing a DoS attack you can try the following.
Open up a cmd prompt and type in the following:
netstat -n -p tcp
This will show you all the active tcp connections.
If you are indeed being DoSsed you will probably see alot of connections here stating 'syn_recieved'. If this is the case then you are probably experiencing a Syn flood attack, one of the most common used DoS attacks.
Taken from:Quote:
Win2K automatically monitors three counters that track the number of active TCP/IP ports and the number of ports in the half-open state to look for potential SYN attacks. When these counters exceed predefined thresholds, Win2K assumes that a SYN DoS attack is in progress. During a SYN DoS attack, TCP queries the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters subkey to determine how to respond. The subkey's SynAttackProtect entry determines the number of retries and the retry interval that TCP uses to time out a connection request. The SynAttackProtect entry has the type REG_DWORD and the value 0, 1, or 2.
Set the value to 1 or 2 on systems that connect directly to the Internet. These settings reduce the number of SYN-ACK retransmissions and the interval between them, which reduces the time that a system waits to time out valid and malicious connection requests. For the best protection against SYN DoS attacks, set the value to 2.
Set the SynAttackProtect entry to 1 or 2 for systems directly accessible from the Internet, especially those you don't protect with a firewall. (To verify that your firewall provides SYN attack and Ping of Death protection, check with the vendor.) Remember that when you implement this deterrent, you change the way the system responds to both valid and DoS connection requests.
http://www.secadministrator.com/Arti...eID=25027&pg=2
More interesting reading:
http://grc.com/dos/grcdos.htm
http://grc.com/dos/drdos.htm
Sure they're easy to trace if the attacker is a total idiot. Otherwise, good luck.
-Maestr0
good luck indeed. are not most DoS attacks using spoofed packets?