Please enable JavaScript.
Coggle requires JavaScript to display documents.
Day 16 – Denial of Service (DoS) Prevention - Coggle Diagram
Day 16 – Denial of Service (DoS) Prevention
DoS Prevention Overview
What is DoS
Disrupts or disables network resources by overwhelming traffic
Prevents legitimate requests from being processed
Why Prevent DoS Attacks
Network disruption and business impact
Resource exhaustion from flood attacks
Protects network and server availability
How DoS Prevention Works
Detect malicious traffic patterns
Set thresholds and limits for traffic
Block or isolate attack sources
Monitor and adjust thresholds based on normal behavior
DoS Policy Configuration
What is a DoS Policy
Defines rules for monitoring, detecting, and preventing DoS attacks
Key Components
Source, Destination, Service, Anomaly Thresholds
How to Configure DoS Policy
Set thresholds for abnormal behavior (e.g., requests per second)
Apply action (block, rate-limit, log) on detected attacks
Customize policies based on network and service requirements
ICMP Flood Protection
What is ICMP Flood
Floods the target with ICMP Echo Request packets (ping)
Overwhelms the target system, making it unresponsive
How ICMP Flood Protection Works
Detects excessive ICMP packets to a destination
Sets limits on allowed ICMP requests per time period
Blocks traffic exceeding the threshold
Why ICMP Flood Protection is Important
Prevents resource exhaustion due to ICMP traffic
Ensures network stability and availability
TCP SYN Flood Protection
What is TCP SYN Flood
Attackers send numerous SYN requests to create half-open connections
Overloads the server’s ability to handle legitimate requests
How SYN Flood Protection Works
Monitors the rate of SYN requests and applies thresholds
Blocks or resets connections exceeding set limits
Why SYN Flood Protection is Important
Prevents denial of service by exhausting server resources
Ensures the server can process legitimate connections
ICMP Sweep Detection
What is ICMP Sweep
Attackers use ICMP Echo Request to probe multiple IPs
Typically used as a reconnaissance technique before an attack
How ICMP Sweep Detection Works
Monitors rapid ICMP requests to multiple IPs
Detects scanning behaviors and blocks or rate-limits traffic
Why ICMP Sweep Detection is Important
Identifies attackers scanning the network for vulnerable devices
Prevents early reconnaissance from leading to further attacks
TCP Port Scan Detection
What is TCP Port Scan
Attackers attempt to discover open ports on a server
Port scanning can identify vulnerable services for exploitation
How Port Scan Detection Works
Monitors traffic for numerous connection attempts to different ports
Blocks or limits scanning attempts
Why Port Scan Detection is Important
Prevents attackers from identifying vulnerabilities for exploitation
Protects internal services from unauthorized discovery
Quarantine Action for Attackers (CLI)
What is Quarantine Action
Isolates or blocks the attacker’s IP temporarily
Prevents further malicious activity during investigation
How to Apply Quarantine Action
Identify attacker IP through logs or IPS detection
Apply temporary block via CLI or policies
Why Quarantine Action is Important
Stops attacks immediately while providing time for investigation
Helps mitigate damage during active attacks
Monitoring DoS Anomaly Logs
What are DoS Anomaly Logs
Logs suspicious traffic patterns indicating a possible DoS attack
Why Monitor DoS Logs
Detect early signs of an attack and assess its severity
Identify sources of traffic that may need to be blocked or rate-limited
How to Monitor DoS Logs
Regularly check logs for unusual traffic spikes or patterns
Review blocked or rate-limited connections
Adjust policies based on ongoing attack patterns