Learning by Doing: CISCO Certified Network ... - SCN Research

Objective:
To learn how to use ACL’s to build a mini-protocol inspector.
Tools and Materials:
(2) workstations
(4) straight-through cables
(1) DCE/DTE serial cable
(2) routers
(2) switches (or 1 with 2 VLAN’s)
Lab Diagram:
Making a Protocol Inspector with ACL’s
Goodguys
ISP
e0 s0/1 e0
s0/0
Good Guy WS ☺
Bad Guy WS
192.168.1.2/24 172.16.1.2/16
Addressing:
Router goodguys ISP
S0/0 (DCE) n/a 220.100.50.1/24
S0/1 (DTE) 220.100.50.2/24 n/a
E0/0 192.168.1.1/24 172.16.1.1/16
Background:
A denial of service attack (DoS) occurs when disruption of services to legitimate users
occurs. Denial of service attacks are gaining in number as evidenced in the media.
Lately we have seen denial of service attacks that have crashed the networks of Yahoo,
Ebay, Buy.com, CNN.com, E*Trade, ZDNet, Microsoft, and others. Initiating DoS
attacks are very simple…the tools are readily available over the Internet. To launch a
DoS attack the attacker needs only a Linux/UNIX box with one of the following
programs: Trinoo, TFN, TFN2K, and Stacheldraht.
There are essentially three main categories of denial of service attacks: smurf,
fraggle, and sync attacks. A smurf attack (not the little blue guy) is caused by a flood of
icmp messages. A fraggle attack is caused by a flood of UDP packets. A sync attack is
caused by a flood of TCP packets. As we can see all three are closely related. We can
354