Sockstress - Effects of The Attacks

Effects of The Attacks

If the attacks are successful in initiating perpetually stalled connections, the connection table of the server can quickly be filled, effectively creating a denial of service condition for a specific service. In many cases we have also seen the attacks consume significant amounts of event queues and system memory, which intensifies the effects of the attacks. The result of which has been systems that no longer have event timers for TCP communication, frozen systems, and system reboots. The attacks do not require significant bandwidth.

While it is trivial to get a single service to become unavailable in a matter of seconds, to make an entire system become defunct can take many minutes, and in some cases hours. As a general rule, the more services a system has, the faster it will succumb to the devastating (broken TCP, system lock, reboot, etc.) effects of the attacks. Alternatively, attack amplification can be achieved by attacking from a larger number of IP addresses. We typically attack from a /29 through a /25 in our labs. Attacking from a /32 is typically less effective at causing the system wide faults.