This lecture reviews some of the details of IP and TCP, highlighting the lack of protection given to IP packet and TCP segment headers. We consider how ICMP, UDP and TCP can be used for network surveillance by an attacker and discuss attacks such as packet sniffing, spoofing and TCP session hijacking. We also address some of the ways in which DDoS can be carried out and consider why the rise in the Internet of Things is creating new opportunities for huge DDoS attacks.

• Lecture video
• Slides (PDF)
• Exercises:
  • Network Scanning
• Other resources:
  • Nmap, a highly sophisticated network mapping tool
  • Blog: I scanned the whole country of Austria and this is what I found
  • Details of the Slowloris DDoS attack and sample attack code
  • Source code for the Mirai IoT botnet
  • Cloudflare says it mitigated a record-breaking 17.2M rps DDoS attack
  • Microsoft fends off record-breaking 3.47Tbps DDoS attack