Using The Command, Arp -s

To begin we must first understand what a Distributed Denial of Service attack is. A DDoS attack per Arbor Network is a n attempt to make an online service unavailable by overwhelming it with traffic from multiple resources (1). With that there are four common categories for the attack types, connection attacks, volumetric attacks, fragmentation attacks, and application attacks (“What Is a DDoS Attack” 1). Connection attacks are an attempt to use up all available connections to the infrastructure devices, to include but not limited to load-balancers and application servers (“What Is a DDoS Attack” 1). The attack is set up to use all the potential connections to stop everyone from being able to connect to a site or service by keeping all the connections open to the attacker’s bot army.

To reduce the risk of these types of attacks, routers should be hardened, packet filtering controls should be used and routing information should be controlled.

One of mitigation technique is based on cross checking of ARP responses and blocking the uncertified ARP responses. This may be integrated with the DHCP server so that both dynamic and static IP addresses are certified. This capability may be implemented in individual hosts or may be integrated into Ethernet switches or other network

There are many different vendors providing various WIPS systems or more complex security solutions all in one. All of them provide the most important feature from the WIPS attack discovery options, to detect rogue access points and unauthorized connections, client devices and ad hoc networks. One of them is Cisco Adaptive Wireless IPS, this uses a network controlled system (NCS) that generates flags as rogue

In this report I will be describing the ways in which networks can be attacked, also be giving real life example of each of the below.

A malicious node can impersonate or spoof the address of another node in order to alter the vision of the network topology as perceived by another node. Such attacks can result in the formation of loops as described below [18]

The Internet Protocol (IP) has some vulnerability that can be exploited to transfer information along the network by being anonymous. Some attempts have been made using IPv4 but now since IPv6 is the new mode of network the challenge is to design it to fit the new trend.

IPv6 uses NDP (Neighbor Discovery Protocol) to find the MAC address. NDP manages interaction between nodes via message exchanges. These messages provide the data necessary for the processes of host auto configuration and packet transmission on a local link. Host auto configuration involves separate tasks of Parameter discovery, address auto configuration and duplicate address detection. Packet discovery is facilitated through router discovery process. It obtains the necessary parameters required for host configuration. Duplicate address detection is used to detect the presence of duplicate addresses on the same link. Packet transmission process requires data which can be obtained by router discovery, prefix discovery, address resolution, neighbor

They exploit network design weaknesses such as sending ping requests to death, or establishing computationally heavy tasks such encryption and decryption of the victim. The attacks have become rampant because hackers have availed the attack tools to help adversaries bypass the weak security measures in place. The attacks can be direct or reflector (Kinicki, 2012).

Smurf Attack: The Smurf Attack is a denial-of-service attack in which large numbers of ICMP packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address. This causes all hosts on the network to reply to the ICMP request, causing significant traffic to the victim's computer. For example, if there are n hosts connected to a network then attacker can make the entire host to send n reply packet to the victim by sending a single packet to

tackers. For example, an attacker might want to get control of an IRC channel via

E-mail bombing attacks are just as they sound. Sometimes referred to as email flooding, an attacker sets up an algorithm to send “a large amount of emails simply fill up the recipient 's inbox” (Goutam 15). Such attacks are designed to crash personal computers and/or the servers they are running on, given the computer is in an office. Attacks are done in one of two ways, the attacker makes a virus that uses others emails to target a specific email, or the attacker simply runs an algorithm off their own computer to send the emails. This attack requires very little experience to do and could potentially send millions of emails to a specific person. While the attack is easy to do, it is also relatively easy to counter. Large companies can simply set up a block to prevent specific emails from getting more than, say, a few hundred emails an hour. In turn, the only targets the attack will likely work on are personal computers or small businesses that do not have a dedicated IT team.

Traditional Honey pot DNS server attacks known as "DNS Redirection Mechanism," the network traffic creates an alternative route from a client to web server. Incident response methods fail to mitigate the risk posed by DNS server attacks because two assumptions are redirecting a DNS request to an actual DNS server, and personality engine, which manipulates the packet content to make it look like it, has originated from the network stack.

The internet is a medium that is becoming progressively important as it makes information available in a quick and easy manner. It has transformed communications and acts as a global network that allows people to communicate and interact without being limited by time, boarders and distance. However, the infrastructure is vulnerable to hackers who use the system to commit cyber crime. To accomplish this, they make use of innovative stealth techniques for their malicious purposes in the internet.

The first category of attacks concerns vulnerabilities within the anatomy of the DNS protocol and the software implementation of the protocol. The second category of attacks concerns