Description

Traffic Flood is a type of DoS attack targeting web servers, the attack explores the way that TCP connection is managed. The attack consists in a generation of a lot of well crafted TCP requisitions with the objective to stop the Web Server or causing a performance decrease.

The attack explores the characteristic of the HTTP protocol, opening many connections at the same time to attend a single requisition. This special feature of the http protocol, which consists in to open a TCP connection for every html object and close it, could be used to make two different kinds of exploitation. The Connect attack is done during the establishment of the connection, and the Closing attack is done during the connection closing.

Severity

High

Likelihood of exploitation

Very High

Examples

Connect attack

This type of attack consists in establishing a big number of fake TCP connections with an incomplete HTTP request until the web server is overwhelmed of connections and stops responding.

The aim of the incomplete HTTP request is to keep the web server, with the TCP connection in Established state, waiting for the completion of the request, as shown in figure1. Depending on the implementation of the web server the connection stays in this state until there is a timeout of the TCP connection or of the web server. This way it’s possible to establish a great number of new connections before the first ones begin to timeout moreover the generation rate of new connections grows faster than the expiring one.

The attack could also affect firewall that implements a proxy like access control as Checkpoint FW1.

Closing Attack

The Closing Attack is done during the ending steps of a TCP connection exploring how some web servers deal with the finalization of the TCP connection especially with the FIN_WAIT_1 state. The attack as explained by Stanislav Shalunov: “ comes in two flavors: mbufs exhaustion and process saturation.

When doing mbufs exhaustion, one wants the user-level process on the other end to write the data without blocking and close the descriptor. Kernel will have to deal with all the data, and the user-level process will be free, so that more requests can be sent this way and eventually consume all the mbufs or all physical memory, if mbufs are allocated dynamically.

When doing process saturation, one wants user-level process to block while trying to write data. The architecture of many HTTP servers will allow serving only a number of connections at a time. When this number of connections is reached the server will stop responding to legitimate users. If the server doesn't put a bound on the number of connections,resources will still be tied up and eventually the machine comes to a crawling halt.

External References

• http://shlang.com/netkill/netkill.html