Michael Coschigano
Network Security
Some DoS attacks can be avoided by applying vendor patches to the software that has been compromised. Another way to deal with DoS attacks in the case of an attack coming from a number of known IP addresses is to put up a rule to drop all incoming traffic from those known attackers. Yet another way to deal with these types of attacks is to set up packet filters. This will act as a proxy for connections. Once the handshake is validated it will be forwarded to the correct destination instead of just forwarding the packet to the destination. TCP SYN flooding attack effects can be reduced or removed by limiting the number of TCP connections a system accepts and by shortening the amount of time a connection stays partially open. This is done by limiting the number of TCP connections made at the entry and exit points of the network structures. (Kaeo, 2004)
Recently there has been a variation of a DoS attack that has caused further problems. This is known as Distributed Denial of Service attack. How this is accomplished is a number of computers are used to launch a DoS attack. The thought is that these attacks come from the external internet. One of the best ways to mitigate this is to set up a firewall between the internet and the trusted network of the corporation. The first step one should take to eliminate this type of attack it to find out precisely what type of attack it is. You want to filter these attacks by creating an access control list; this will permit or deny traffic. One other way to deal with this is rate limiting. What this will do is limit the quantity of traffic being sent or received through the network. (Kaeo, 2004)
Another threat is IP Spoofing. This is accomplished by providing fabricated information about a person’s or host’s identity to obtain unauthorized access to a system. By enabling packet filters at the entry and exit points of your networks you can best guard against spoofing. The external entry point filters should explicitly deny any inbound packets that perceive to derive from a host that is in the internal network. The internal exit point filters should permit only outbound packets that originate from a host within the internal network. (El-Moussa, 2007)
An effective instrument that can alert you during a Smurf attacks is to configure filters that would permit ICMP echo requests/replies aiming at Smurf attacks. By making logs and observing this traffic, it will be possible to detect when this type of attack is in progress. Equally, distributing firewall functionality and intrusion detection allows for the detection and defence of an attack. To detect a Smurf attack active routers count how many broadcast ICMP Ping packets have been received from either the same client or from the same router. . (El-Moussa, 2007)
The land.c attack is used to launch DoS attacks against various TCP implementations. IDS implementations can usually detect land.c attacks by watching for IP packets that have a source IP address identical to the destination address. This is known as an impossible IP packet. Though a network-based IDS can sense this kind of packet and cause an alarm, but it will not stop the packet from getting to its target if it is in sniffing mode only. So then an alarm will be generated, and the system administrator has to take suitable ant spoofing actions to prevent further attack efforts. . (El-Moussa, 2007)

References

El-Moussa, F. A., Linge, N. N., & Hope, M. M. (2007). Active router approach to defeating denial-of-service attacks in networks. IET Communications, 1(1), 55-63. doi:10.1049/iet-com:20050441

Kaeo, M. (2004). Designing network security. (2 ed.). Indianapolis: Cisco.