Lesson 11.3 - DoS

Question 1

What is DnS?

Answer 1

Attempt to exhaust resources

• Network bandwidth
• TCP connections
• Server resources

Question 2

What are the 3 defenses against DoS?

Answer 2

1. Ingress filtering
2. uRPF checks
3. Syn Cookies (TCP)

Question 3

What is Ingress filtering

Answer 3

a technique used to ensure that incoming packets are actually from the networks from which they claim to originate.
+ Fool proof
+ works at edges
- doesn’t work in core

Question 4

What is uRPF filtering?

Answer 4

Whenever your router receives an IP packet it will check if it has a matching entry in the routing table for the source IP address.
+ automatic
- require symmetric routing

Question 5

What is the problem with 3-way handshake

Answer 5

Buffer allocation on the server if flooded with Syns and no Acts

Question 6

SYn cookie solution to TCP

Answer 6

No buffer allocation. THe server instead keeps no state and then sends a sequence number a function of IPs and ports, and a random

Question 7

What are the advantages of TCP SYN Cookies?
A: Can be applied in the network “core”
B: Prevent server from exhausting state after TCP Syn
C: Defends against UDP Flooding attacks

Answer 7

B: Prevent server from exhausting state after TCP Syn