Denial of service attacks – an updated perspective

Figures & data

Figure 1. Layers of the OSI reference model.

Figure 2. Functions and protocols in the OSI reference model.

Table 1. Most commonly exploited protocols at application layer.

Protocol	Attack method
HTTP	HTTP Malformed Attacks, HTTP Request Attacks and HTTP Idle Attacks
DNS	DNS Query/Answer Malformed Packet, DNS Query-Length Buffer Overflow, DNS Query Buffer Overflow, Man-in-the-Middle, DNS Cache Poisoning Attacks, DNS Amplification Attacks and DNS Dictionary Attacks
VoIP	SIP INVITE Flood Attacks, SIP Call Setup Request Attacks, SIP Malformed Packet Attacks, Real-Time Transport Protocol (RTP) and Flood/Quality of Service (QoS) Attacks
SMTP	SMTP Error DoS, Mailbox DoS Attack (Excessive Email Size), SMTP Mail Flooding attacks and SMTP Buffer Overflow Attacks: Different SMTP commands can cause the SMTP server to crash or execute arbitrary

Figure 3. Most common protocols targeted for application layer attacks.

Table 2. Most common tools used for DoS attacks at application layer.

Tool	Attack method
LOIC	UDP, TCP, or HTTP (HTTP GET method)
R.U.DY (R U Dead Yet?)	[HTTP POST]
Slowloris	HTTP GET
Dirt Jumper	HTTP flood, SYN flood, POST flood
Tor's Hammer	Slow POST
Nuclear DDoSer	Slowloris, Slow POST
Railgun	Slowloris or Slow POST

Table 3. Most common tools used for DoS attacks at transport layer.

Tools	Description	Attacks
Macof Dsniff	Macof is a tool that can flood a switched LAN with random MAC addresses. Macof is also included in Dsniff.	MAC Attacks
Linux Bridges	A project to develop Ethernet bridges using Linux. Source codes are available.	STP Attacks
Stp.c	A source code in c language that can generate BPDU frames. The code can be used as a framework to write STP attacking tools.	STP Attacks
IRPAS	Internetwork Routing Protocol Attack Suite (IRPAS) is a suite of tools developed for attacking routers. A tool called CDP attack is also included	CDP Attacks
Ettercap	Ettercap is a multifunction sniffer for switched LAN. It can be used for password capturing, packet filtering and dropping, passive OS fingerprinting, and connection killing. It also supports plugins that can launch STP and ARP attacks.	STP Attacks, ARP Attacks and MAC Attacks
Libdnet	Libdnet is a testing program that can be used to change a network's configuration by generating ARP request packets.	ARP Attacks
VLAN Attacks	VLAN attacks	VLAN Attacks
Gobbler	Gobbler is a tool that can launch DHCP attacks. Gobbler can gobble all available IP addresses in a network and can perform man-in-the-middle attacks.	DHCP Attacks
SToP	SToP is an utility that can modify any relevant field in the BPDU messages. It can generate enough packets to flood a network.	STP Attacks

Table 4. Summary of DoS attacks.

OSI layer	Functions	Protocol(s)	DoS attack method	Impact of DoS attack	Attack tools
Application Layer	It supports application and end-user processes by identifying communication partners, ensuring quality of service, providing user authentication and privacy. It interacts with the applications such as file transfers, e-mail and other network software services	Telnet, FTP, SMTP, HTTP	HTTLP GET request, HTTP POST request, DNS malformed packets, VOIP and SMTP	Resource starvation	LOIC, RUDY, Slowloris, Dirt Jumper, Tor's Hammer, Nuclear DDoSer and Railgun
Presentation layer	It helps in providing uniformity in data representation (e.g. encryption) by translating from application to network format, and vice versa. It transforms data into the format that the application layer can accept. The layer formats and encrypts data to be sent across a network, providing freedom from compatibility problems	SSL	Malformed SSL request	Resource starvation	THC-SSL-DOS
Session layer	It is responsible for establishing, managing and terminating connections between applications. The layer sets up, coordinates, and terminates sessions, exchanges, and dialogues between the applications at each end. It deals with session coordination	Telnet	Deny remote login services	Unavailability of Telnet services for remote administration	–
Transport layer	It providesend-to-end transmission of data between hosts. It ensures end-to-end error recovery and flow control. It is responsible for the complete data transfer	TCP, UDP	SYN attacks, Smurf attacks	Consume resources like bandwidth, connections, causes unavailability of services	Trinoo, Brobot, Tribe Flood Network, TFN2K and Stacheldraht
Network layer	It is responsible for switching and routing of packets, through virtual connections, for transmitting data from node to node. Other functions of this layer include addressing, internetworking, error handling, congestion control, and packet sequencing	IP	Flooding-based attacks	Causes unavailability of bandwidth and other services
Data link layer	At this layer, data packets are encoded and decoded into bits. It handles errors in the physical layer, flow control and frame synchronization	IEEE 802	MAC flooding attacks	Interrupt normal flow of traffic between sender and receiver	Macof /Dsniff, Linux Bridges, Stp.c, IRPAS, Ettercap, Libdnet, VLANand Gobbler, STOP
Physical layer	It transfers the bit stream – electrical impulse, light or radio signal – through the network at the electrical and mechanical level. It interfaces the hardware for sending and receiving data on a carrier, including defining cables, cards and physical aspects	Ethernet, RJ45, etc.	Destruction, obstruction, and manipulation of media	Interruption in communication through physical media	–

Figure 4. Tools used to detect threats.

Figure 5. Effectiveness of detection mechanisms.

Figure 6. DoS threat mitigation techniques.