An Analysis and Fingerprinting of a Distributed Denial of Service Attack

摘要

A server at the College of Computing, Georgia Institute of Technology, was subjected to a denial of service (DoS) attack on March 27, 2001. A Cisco router's Netflow functionality was used to gather flow-level information on the attack's traffic. This paper analyzes the captured data to explore the dynamics of the attack and the characteristics of the attacking packets. We also seek to determine what tools were used to launch the attack and make some postulations as to the motivation behind the attack.