Network attacks

Network attacks can be divided into three classes:

• Denial of Service attack

  • Denial of Service (DoS) attack is to attack a system by sending a large number of data packets. As a result, the system cannot receive requests from valid users normally or the host is suspended and cannot work normally.

    The main DoS attacks includes SYN Flood, UDP Flood and DNS Flood.

    Differing from other types of attacks, the DoS attackers prevent valid users from accessing resources or devices in stead of searching for ingresses of internal networks.

  • Distributed Denial of Service (DDoS) attack is a type of the DoS attack where the attackers control tens or hundreds of computers to attack one host. As a result, the host cannot accept the normal requests from users or fails to work normally.

• Scanning and snooping attack

  Scanning and snooping attacks mainly include IP sweeping and port scanning. IP sweeping means that the attacker sends IP packets such as TCP, UDP, and ICMP packets whose destination addresses change instantly, to find existing hosts and networks. In this manner, the potential attack targets can be detected accurately. Port scanning means that the attacker scans TCP and UDP ports to detect the operating system and potential services of the attack target. By scanning and snooping, the attacker can roughly learn the types of services the target system provides and the potential security vulnerabilities the target system has, to prepare for further intrusion on the target system.

• Defective packet attack

  Defective packet attack is to send a defective IP packet to the destination system so that the system will crash when it processes the IP packet. The main defective packets include Ping of Death and Teardrop.