Learning by Doing: CISCO Certified Network ... - SCN Research

actually build a mini-protocol inspector to help us detect these three types of DoS attacks
when other equipment is not available.
Allow me to “set the stage…”
You are the network administrator in a small company…you do not have the big
bucks to buy those expensive protocol analyzers and network inspectors.
However, you have noticed your internet speeds, while guaranteed at T-1 for your
38 users, has actually been extremely slow. In fact, everyday it seems to get
slower. Also the computers have been randomly crashing and being disconnected
from the network with no clear indications why they have been doing that. You
are really starting to rack your brain over this one…
What is happening is your network is the victim of one of these denial of service attacks.
You can put a small acl which acts like a protocol inspector. Let’s see how.
Step-By-Step Instructions:
1. Set up and cable the lab as shown.
2. Add in our “mini-protocol inspector”
goodguys(config)#access-list 100 permit icmp any any echo
goodguys(config)#access-list 100 permit icmp any any echo-reply
goodguys(config)#access-list 100 permit udp any any eq echo
goodguys(config)#access-list 100 permit udp any eq echo any
goodguys(config)#access-list 100 permit tcp any any established
goodguys(config)#access-list 100 permit tcp any any
goodguys(config)#access-list 100 permit ip any any
goodguys(config)#int s0/1
goodguys(config-if)#ip access-group 100 in
The first two lines helps us monitor and record Smurf attacks, the next two helps
us monitor and record fraggle attacks, and the next two help us monitor for sync
attacks. Once we know where the attacks are coming from we can write other
acl’s to stop them (and to tell the authorities).
3. Let’s use the “evil” workstation to launch a vicious icmp flood to our goody two
shoes network using DOS
***Remember this is highly illegal…do not do this outside of lab conditions***
Ping 192.168.1.2 –t –l 50000 (or try 500 then 5000)
4. Then let’s up it a bit by opening more DOS windows and slamming goody some
more…three or four windows should suffice.
5. When we have had our fun we can use control+C to stop the ping storm.
6. Next we can use the show access-list command to look for matches (and potential
attacks).
355