Forensics Web Site a Must-See

 
 
By Cameron Sturdevant  |  Posted 2002-04-22 Email Print this article Print
 
 
 
 
 
 
 

Having trouble with DoS attacks? Want to figure out a way to see who's behind them or at least track down the source?

Having trouble with DoS attacks? Want to figure out a way to see whos behind them or at least track down the source?

The complete answer is likely still some way off, but IT managers who want to track the latest forensic and sleuthing technologies should start at citeseer.nj.nec.com/park00effectiveness.html. This NEC ResearchIndex portal is loaded with links to papers that discuss the technical nitty-gritty of denial-of-service attacks, including the effectiveness of probabilistic (as opposed to deterministic) packet marking. This will be of interest not only to IT managers whose networks are vulnerable to DoS attacks but also to service providers that can unknowingly transmit problem traffic. Probabilistic schemes focus on adding compressed information to likely attack packets, thus giving victims a clue as to the origin of the attack.

The obvious problem with this approach is that a large volume of "good" traffic is likely to get confused with the bad, which could mean a significant increase in overhead processing for enterprise networks. I recommend that network managers skulk around on the site and spend at least a couple of hours digesting the material. At the very least, youll learn what makes it so hard to track down DoS attackers. And the site makes it easy to pick up pointers on how to protect your network today.

 
 
 
 
Cameron Sturdevant Cameron Sturdevant is the executive editor of Enterprise Networking Planet. Prior to ENP, Cameron was technical analyst at PCWeek Labs, starting in 1997. Cameron finished up as the eWEEK Labs Technical Director in 2012. Before his extensive labs tenure Cameron paid his IT dues working in technical support and sales engineering at a software publishing firm . Cameron also spent two years with a database development firm, integrating applications with mainframe legacy programs. Cameron's areas of expertise include virtual and physical IT infrastructure, cloud computing, enterprise networking and mobility. In addition to reviews, Cameron has covered monolithic enterprise management systems throughout their lifecycles, providing the eWEEK reader with all-important history and context. Cameron takes special care in cultivating his IT manager contacts, to ensure that his analysis is grounded in real-world concern. Follow Cameron on Twitter at csturdevant, or reach him by email at cameron.sturdevant@quinstreet.com.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date
Rocket Fuel