Perl Script That Tracks DoS Attacks

Architecture and Background

Description from DEF CON 9 Speaker’s Page: A Perl script that tracks Denial of Service attacks across Cisco backbones.

Vulnerability Analysis

Due to the increasing ease of spoofing the source IPs of a DDoS attack, correctly finding where the traffic is entering your network becomes more difficult.

Exploitation and Demonstrations

Rather than being able to traceroute via normal routing methods, most tracing of spoofed addresses has to be done hop by hop, one router at a time.

Remediation and Defensive Strategies

In a large backbone, this can take hours, particularly when you consider that many DDoS attacks come from hundreds of different IP addresses. Raven Alder is a senior network engineer for a Tier 1 ISP, and hunts down DDoS attacks in the wild for fun. In addition to supporting Cisco routers, Raven is also a Solaris/Linux/BSD sysadmin, and enjoys Shorin Ryu martial arts and particle physics.