Suppose as an attacker i want to carry out a Ping or SYN Flood attack.. I can ch

Question

Suppose as an attacker i want to carry out a Ping or SYN Flood attack..

I can change the source IP of the packets generated at my machine to a false/spoofed public IP address so that replies go to that spoofed IP to avoid detection.

A WiFi router or any device for that matter .. would it drop the packet if source IP was a spoofed public IP or does it forward the packet to the destination or does NATing take place and the reply comes back to the router public IP address?

How would IP Spoofing work in this case? ..what is the general behavior of networking devices here

Explanation / Answer

It depends on your router settings.

- If your router have filtering in place, it will drop the packet, as it's source address is not from any networks known by the router. I usually configure my gateways/firewalls/routers to do this.

- If your router does not have any filtering (the most common scenario) it will change the source address on the packet to its own address, and put an entry in an internal table to "remember" to which connection the packet belongs. As soon as it gets a response, the router will look at that internal table to see where to send the packet. As the address is not from any internal network, the router will send the packet away to the default gateway.

Edit: DDoS botnets generally don't rely on this method. They generally consist of dozens (or hundreds) of thousands of infected computers, waiting a command to attack some site. When the command arrives, all infected computers connect to the same site at once. If a botmaster have 100.000 bots on its network, each one with an average 4mbps downlink, it can theoretically generate 400Gbps of traffic.

There's another DDoS method, called amplification. It works by faking the source and sending a packet to a service that returns more data than it was send. DNS and NTP are the most common abused protocols. DNS amplification uses about 60 outgoing bytes and often results in over 4k bytes returning. Its a 70:1 ratio.

In this case, a very small botnet (10.000 bots with average 4Mbps connection) can generate enough traffic to knock down lots of sites.

Related Questions

Navigate

• Browse (All)
• Browse S
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.