This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "Traffic flood"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
{{Template:Attack}}
+
{{Template:attack}}
  
{{Template:Stub}}
+
==Description==
 +
 
 +
Traffic Flood is a type of DoS attack targeting web servers, the attack explores the way that TCP connection is managed. The attack consists in a generation of a lot of well crafted TCP requisitions  with the objective to stop the Web Server or causing a performance decrease.
 +
 
 +
The attack explores the characteristic of the HTTP protocol, opening many connections at the same time to attend a single requisition.  This special feature of the http protocol, which consists in to open a TCP connection for every html object and close it, could be used to make two different kinds of exploitation.
 +
The Connect attack is done during the establishment of the connection, and the Closing attack is done during the connection closing.
  
==Description==
 
  
This article should cover the use of flooding to deny service to legitimate users.
+
==Examples==
 +
 
 +
===Connect attack===
 +
 
 +
This type of attack consists in establishing a big number of fake TCP connections with an incomplete HTTP request until the web server is overwhelmed of connections and stops responding.
 +
 
 +
The aim of the incomplete HTTP request is to keep the web server, with the TCP connection in Established state, waiting for the completion of the request, as shown in figure1. Depending on the implementation of the web server the connection stays in this state until there is a  timeout of the TCP connection or of the web server. This way it’s possible to establish a great number of new connections before the first ones begin to timeout moreover the generation rate of new connections grows faster than the expiring one. 
 +
 
 +
[[Image:Traffic.jpg]]
 +
 
 +
The attack could also affect firewall that implements a proxy like access control as Checkpoint FW1.
 +
 
 +
 
 +
===Closing Attack===
 +
 
 +
The Closing Attack is done during the ending steps of a TCP connection exploring how some web servers deal with the finalization of the TCP connection especially with the FIN_WAIT_1 state.
 +
The attack as explained by Stanislav Shalunov: “ comes in two flavors: mbufs exhaustion and process saturation.
 +
 
 +
When doing mbufs exhaustion, one wants the user-level process on the other end to write the data without blocking and close the descriptor. Kernel will have to deal with all the data, and the user-level process will be free, so that more requests can be sent this way and eventually consume all the mbufs or all physical memory, if mbufs are allocated dynamically.
 +
 
 +
When doing process saturation, one wants user-level process to block while trying to write data. The architecture of many HTTP servers will allow serving only a number of connections at a time. When this number of connections  is reached the server will stop responding to legitimate users. If the server doesn't put a bound on the number of connections,resources will still be tied up and eventually the machine comes to a crawling halt.
 +
 
 +
 
 +
==References==
 +
 
 +
* http://shlang.com/netkill/netkill.html
  
==Examples ==
 
  
 
==Related Threats==
 
==Related Threats==
  
 +
[[:Category:Logical Attacks]]
 +
 +
 
==Related Attacks==
 
==Related Attacks==
 +
 +
*[[Denial of Service]]
 +
  
 
==Related Vulnerabilities==
 
==Related Vulnerabilities==
 +
 +
[[:Category:General Logic Error Vulnerability]]
 +
  
 
==Related Countermeasures==
 
==Related Countermeasures==
  
[[Category:Attack]]
+
[[:Category:Denial of Service Attack]]
 +
 
 +
 
 +
==Categories==
 +
 
 +
[[:Category:Protocol Manipulation]]

Revision as of 12:08, 31 October 2007

This is an Attack. To view all attacks, please see the Attack Category page.


Description

Traffic Flood is a type of DoS attack targeting web servers, the attack explores the way that TCP connection is managed. The attack consists in a generation of a lot of well crafted TCP requisitions with the objective to stop the Web Server or causing a performance decrease.

The attack explores the characteristic of the HTTP protocol, opening many connections at the same time to attend a single requisition. This special feature of the http protocol, which consists in to open a TCP connection for every html object and close it, could be used to make two different kinds of exploitation. The Connect attack is done during the establishment of the connection, and the Closing attack is done during the connection closing.


Examples

Connect attack

This type of attack consists in establishing a big number of fake TCP connections with an incomplete HTTP request until the web server is overwhelmed of connections and stops responding.

The aim of the incomplete HTTP request is to keep the web server, with the TCP connection in Established state, waiting for the completion of the request, as shown in figure1. Depending on the implementation of the web server the connection stays in this state until there is a timeout of the TCP connection or of the web server. This way it’s possible to establish a great number of new connections before the first ones begin to timeout moreover the generation rate of new connections grows faster than the expiring one.

File:Traffic.jpg

The attack could also affect firewall that implements a proxy like access control as Checkpoint FW1.


Closing Attack

The Closing Attack is done during the ending steps of a TCP connection exploring how some web servers deal with the finalization of the TCP connection especially with the FIN_WAIT_1 state. The attack as explained by Stanislav Shalunov: “ comes in two flavors: mbufs exhaustion and process saturation.

When doing mbufs exhaustion, one wants the user-level process on the other end to write the data without blocking and close the descriptor. Kernel will have to deal with all the data, and the user-level process will be free, so that more requests can be sent this way and eventually consume all the mbufs or all physical memory, if mbufs are allocated dynamically.

When doing process saturation, one wants user-level process to block while trying to write data. The architecture of many HTTP servers will allow serving only a number of connections at a time. When this number of connections is reached the server will stop responding to legitimate users. If the server doesn't put a bound on the number of connections,resources will still be tied up and eventually the machine comes to a crawling halt.


References


Related Threats

Category:Logical Attacks


Related Attacks


Related Vulnerabilities

Category:General Logic Error Vulnerability


Related Countermeasures

Category:Denial of Service Attack


Categories

Category:Protocol Manipulation