LOIC/HOIC DDOS Attack

[Anonymous]

Hi All,

Can any on help me how to detect DOS or DDOS attack on the netwitness. I know this is something strange question but I faced it on my client side. I found there were few TCP packets which is having only 60 bytes and payload is having zero data and flag reset. On the same time I found few hits on the UDP traffic where source port is 53 and destination is 0 or dynamic 4 digit port numbers. I found it very strange and few of the UDP packet got root server boot information. Reported same to monitoring team and they also informed there is instant spike of TCP and UDP packets.

This suspects me it should be LOIC DOS attack where as I am not able to confirm it where as I asked to block immediately for few external IPs from which I saw major amount of hits.

Please suggest me if is there any good rule or observation for DOS/DDOS.

[RSAAdmin · Accepted solution]

Anil,

Good questions.  For most enterprises, the packet capture is typically deployed INSIDE the firewall and other perimeter control systems and this type of traffic is not typically visible.  LOIC usually has a payload that is observable.  Some of the things you describe-  the source port 53 for instance, sounds more like a DNS reflective attack.

Create some rules that describe the traffic you are seeing-  for instance, service=0 && tcp.srcport=53

Zero payload rule of payload=0

Then create an informer chart that monitors these types of alerts in real time, so when there is a spike in activity you can observe it and initiate your response workflow.

[Anonymous]

The report is not giving me any result where as hits are there. I am not sure

[RSAAdmin]

Remember, you have to create capture rules on the decoder to see this traffic.  Sourceports are not indexed.  Once you put the decoder rules in place you should be able to create an informer report looking for that rule alerting

[Anonymous]

Apart from informer charts, is there any other way to detect it, like on the decoder dashboard there were real time graphs for CPU and session capture.

Is it possible to create real time graph for network traffic capturing because session capture would not be the good solution for DOS detection.

Now this is become very serious discussion on my client side as they got warn from twitter.

[RSAAdmin]

Charting on the decoder is for decoder processes and metrics and does not look into packet payloads.  Again, however DDoS happens at the perimeter.  If a decoder is deployed there you might see the traffic, and if the DDoS is a very strong one, the decoder might have problems maintaining capture. 

Using software that analyzes routers to look for DDoS attacks is the better way to approach this issue.