Hardware Is Only Part of the Solution

A denial-of-service attack can cripple a network, even if access isnt gained, and a single distributed-denial-of-service onslaught can disable a multitude of systems. Products including Top Layer Networks Inc.s Attack Mitigator Version 1.0 can help a lot, as can firewalls, operating system patches, additional servers and working with ISPs to choke off DoS traffic further upstream. (Go to www.eweek.com/links for eWeek Labs March 25 Special Report on security.)

Although some DoS attacks use only small amounts of carefully crafted packets to jam servers, routers and firewalls, many—especially the DDoS variety—consume all available bandwidth between the ISP and the target site.

IT staffers from a variety of disciplines must work together to stop future DoS attacks and take the necessary steps to unclog network pipes.

IT staff should begin a conversation with their organizations ISP. Its best to do this before the heat of a DoS attack is melting the network. Make a list of the names and phone numbers of people at the ISP network operations center, and keep it on a grab sheet in your central IT area.

Its also worth taking a look at RFC 2267 "Network Ingress Filtering" by Paul Ferguson and Daniel Senie (accessible from www.eweek.com/links). This document has an excellent discussion of a Syn attack and how ingress filtering on various devices can alleviate the problem. It also describes some of the techniques used by packet-filtering products to stop attacks.

The 80s are Over

Limiting connections or even eliminating some kinds of TCP/IP traffic through filters on edge routers is another good way to minimize exposure to DoS attacks. For example, most firewalls limit ICMP (Internet Control Message Protocol) messages. In the early 1980s, ping and other ICMP messages were necessary to control transmissions because bandwidth was extremely limited, and routing devices capabilities were rudimentary.

But these days, ICMP is almost like a public back door into the network. Other than initial trouble-shooting, there is almost no reason why a ping should be allowed to cross the network border. An inbound ICMP echo reply is surely a sign that mischief is afoot.

To prevent directed broadcast attacks, network managers and system administrators should work together to apply patches to every device that can take one. For example, routers and Layer 3 switches often have some ability to determine if rudimentary broadcast-based attacks have been launched. At the very least, many of these devices and server operating systems can be configured not to respond to broadcast network messages.

Service packs are available for most versions of Windows and Unix that prevent fragmented packet attacks including teardrop, boink.c and syndrop.c.

Senior Analyst Cameron Sturdevant is at cameron_sturdevant@ziffdavis.com.