compromised hosts to attack a site. Therefore, you have multiple origins of hostile hosts simultaneously attacking the victim site. The intent is to clog the portals of the victim site by consuming the resources for handling legitimate traffic. The victim site has to figure out a way to block the DDoS traffic while still allowing the legitimate traffic.

DDoS Software

Historically, four different DDoS programs were known: Trinoo, Tribe Flood Network (TFN), TFN2K, and Stacheldraht (German for barbed wire). With each new release, they seem to have evolved into more complex packages with richer functionality. Most work on Linux or Solaris hosts, and TFN2K works on Windows NT hosts. Reports of new Windows-like DDoS are surfacing.

Some new terminology must be introduced. At the top of the DDoS attack, you have a host, usually known as the client, which is used by the person coordinating the attack. Next, at a layer below that, you have a host or hosts known by the term master or handler. The master controls subservient hosts to launch attacks. Finally, at the bottom, you have hosts known both as agents or daemons, which actually launch the attacks. The terminology gets tricky because it sometimes differs for the individual attacks.

Trinoo

This software uses controlling hosts known as masters, and attacking hosts known as daemons. The communications between the client and the masters and the masters and the daemons is done using TCP and UDP. There are standard ports, but these can be altered. Trinoo can send only UDP floods to random destination port numbers on the victim host. Communications between hosts in an unaltered configuration are as follows:

TFN

Chapter 4, "ICMP," discussed TFN. Basically, there are TFN masters and daemons, which again represent the controlling hosts and the attacking hosts. The communication between master and daemon is done via an ICMP echo reply. The ICMP echo reply can direct the daemon to send a UDP flood, TCP SYN flood, ICMP echo flood, or a Smurf attack. The master can manipulate the IP identification number and payload of the ICMP echo reply to identify the type of attack to be launched. TFN can also spoof the source IP to hide the origin of the attack.

TFN2K

TFN2K was the first of the DDoS programs to be transported to Windows. The communications between the master and agents can be encrypted and can be over TCP, UDP, or ICMP with no identifying ports. The master can spoof the source IP so that if it is detected, the real master cannot be identified. The agent can attack using a TCP SYN flood, a UDP flood, ICMP flood, or Smurf (as we saw with TFN). Additionally, the attacking agent can alternate among these types of attacks for any given attack. And, the agent-generated attack packets have a spoofed source IP by default.