Respected sir/ma'am We are developing our major project in our college on "Designing detection and defense mechanism against DDos attacks". We have come up with the following problem : Our software is not detecting(sniffing) the ethernet packets when Windows Firewall is activated whereas Wireshark detects. Can you help us with the problem? Expecting your reply as soon as possible. Thank you. asked 24 Jan '16, 00:53  Shubham Agarwal edited 24 Jan '16, 06:45  sindy |
One Answer:
To answer your basic question: Wireshark's capturing engine, the WinPcap in case of Windows, gets access to incoming packets before the Windows firewall, which itself gets access to them before any application software. While WinPcap does not affect the packets, just saves a copy of them, the Windows firewall is able to block them before they could reach the application software. So to make your software see all incoming packets:
I would like to hear more about the "defense mechanism" part, though. answered 24 Jan '16, 03:13 sindy edited 24 Jan '16, 03:28 |
A little side-note: sometimes, even WinPCAP can't capture everything. There are numerous questions on this Q&A site where it turned out that personal firewalls, anti-virus or other security software prevented capturing at least some incoming packets
Respected Sir/Mam, Thank You for your valuable reply.
Regarding our defense module we need to just drop the packets that we detect as malicious. Now the problem in this part is how can we actually drop or dump a packet once it is received or how can we actually hook our application before firewall so that we can then use the windows firewall as a filter.
Thank You.
That is another topic which has nothing to do with Wireshark. You need to familiarize with the Windows network APIs I guess.
That is what I was afraid of:
Leaving aside what kind of hooking to the kernel you'd have to use, which is definitely out of scope of this site as @Jasper has pointed out, have you ever thought through what a DDoS attack actually means?
As you've mentioned a Windows machine I assume your Ethernet card's maximum bitrate is 1 Gbit/s. As an attacker, I can easily take a battle unit of 2000 zombies (someone else's computers which I or someone else have previously infected with malware and thus made it possible for me to execute tasks on them remotely, without the owner noticing at least for some time) and make each of them send a packet flow of 500 kbit/s to your server.
This way, I will clog the full bandwidth of your server's Ethernet card, so the requests from real clients of your server application will hardly squeeze between the tons of the malicious ones. Therefore, your solution running at the target server may be dropping the packets from source IPs it has identified as malicious ones, but most of your clients will not be served anyway as most of their requests will not ever reach your server.