Subject: [manet] Can we use the packet loss rate to detect DOS attack?

From: Jianfeng Cai <[email-masked]>
Date: Tue, 21 May 2002 10:17:33 -0700 (PDT)

Hi, all,

I am a newcommer in ad hoc network field. 
I get a question of Denail-of-service attack. In case
a malicious node resides on a route, it drops packets
according to a possibility, say dropping 20% or 30%.
Can we detect this attack by looking at the packet
loss rate?

In another word, can we get normal packet loss rates
for specific environments?

thanks,

Jianfeng 

__________________________________________________
Do You Yahoo!?
LAUNCH - Your Yahoo! Music Experience
http://launch.yahoo.com

_______________________________________________
manet mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/manet

---

From: Fred Baker <[email-masked]>
Date: Tue, 21 May 2002 22:53:42 -0500

At 10:17 AM 5/21/2002 -0700, Jianfeng Cai wrote:
>Can we detect this attack by looking at the packet loss rate?

not really. We can detect the onset of a potential attack by a change in 
the loss rate, but we have to look at the traffic to tell whether there is 
an elastic application running that should have adapted by didn't (SYN 
attack, for example) or an inelastic application run amuck, perhaps due to 
a remote routing change.

---

From: Fred Baker <[email-masked]>
Date: Tue, 21 May 2002 22:53:42 -0500