Using Wireshark to Detect a SYN Flood Denial of Service Attack

[Music] [Music] hello my name is Paul I'm a computer-generated avatar I will be guiding you through the process of using Wireshark to analyze a denial of service attack with constant and ever-increasing online threats against networked computer systems it is essential to have a solid comprehension of network security understanding the fundamentals in necessities of using a network packet analysis tools such as Wireshark is key to pinpointing how where and when an attack happened if users are able to capture and understand network traffic at the packet level they will then have the capability to analyze troubleshoot and recognize any network that has suspicious traffic with malicious intentions and they will have the necessary tools to prevent these types of attacks to understand how a sent flood attack works it helps to know how a TCP connection with a server is established the TCP connection is established using what is known as a three-way handshake in this process a host sends a syn syncronize request message to another host server to ask for a connection then the server acknowledges this connection request by sending a syn ACK synchronize acknowledgment message back to the requesting server the final step of the handshake is when the original host sends an ACK acknowledgement message back to the server which completes the establishment of the connection and now data transfer can begin in a sent flood the attacker transmits a large quantity of syn packets to the server using spoofed IP addresses which induces the server to send a reply syn ACK and leave its ports half open this causes the destination server to wait which consumes the server's resources the connection will eventually timeout but the attacker continues to flood the server numerous malicious send requests this ongoing flood of malicious send request messages stops legitimate send requests from connecting and essentially takes down the network Wireshark is an open-source packet analysis tool that should be included in every networking professionals tool Bank it is important to note that Wireshark should only be run on a network that you own or have been given explicit permission to monitor Wireshark is available for Windows Mac OS and Linux operating systems and can be downloaded from HTTP ww-why org slash download HTML to start a packet capture in Wireshark you must first select the interface that you want to capture the packets on then click the blue shark fin on the menu bar to stop the capture click the Red Square on the menu bar there are three parts to the Wireshark interface the first section is the packet list panel this goes into detail over the time that each packet was sent source address destination address protocols being used packet lengths and other details about the packet under the packet list is the packet details panel as the name suggests this is where to find more detailed information about each packet the packet bytes panel gives a hexadecimal representation of the packet data here we see a wireshark capture on a synth led attack when a TCP filter is applied a large volume of TCP packets can be seen upon closer inspection you can see that the packets are coming from two sources 192.168.0.1 which is the targeted computers IP and one hundred forty seven point two hundred forty eight point two hundred nineteen point 59 the attackers spoofed IP you will also notice that the packets are being sent from multiple ports to a single port on the target machine port 80 as we scroll through the list we start to notice multiple syn packets without cineq replies the target machine is now starting to become overwhelmed a little farther down we can see that the target machine is Maori sending multiple Sinek transmissions and finally the target machine begins ascending connection reset requests these are almost always a sure sign of a denial of service attack in Wireshark if you click on statistics in the menu bar then click on I Oh graph you can see the high volume of TCP errors they even go over 5,000 packets per second at the highest point if you remove the TCP display filter and click statistics then protocol hierarchy you will see that ninety-nine point eight percent of all packets are TCP packets there are multiple ways to prevent a syn flood attack a process called filtering can be used within server firewalls to block incoming malicious send requests a rule can be set up to drop a group of unusual IP addresses the process of using proxies is when a certain threshold is exceeded within the destination server then connection procedures are sent to a proxy server to monitor the proxy server monitors them until they are completed and then returns them to the destination server send cookies is a process that can be activated when a threshold of syn requests are received by a server the destination server responds to the syn request message by dropping the original sent packet and sending back an encrypted syn/ack packet if the destination server receives an appropriate response it will allow the connection to be established if it doesn't get an appropriate response it will note the requesting sent as a syn flood attack and terminate the half-open connection as long as threats against networks persist it is imperative to have a strong security foundation network evaluation tools like Wireshark are indispensable for identifying and preventing these types of intrusions if administrators and end-users are skilled at capturing and interpreting communication at the network layer they will possess the means to evaluate and recognize any questionable traffic and they will have the fundamental skills necessary to halt these threat actors on behalf of elder Joseph John Evan and myself thank you for watching for more information please check out these resources [Music] [Music] [Music]

Channel: John Kuhns

Views: 5,668

Keywords:

Id: VBUxA_95KoY

Length: 8min 56sec (536 seconds)

Published: Wed Jun 24 2020