Network Congestion Solution for FTP Services
"Learn about a solution for network congestion in FTP services using distributed firewall and Snort technology. This research delves into managing UDP flood attacks and the software utilized for analysis and protection."
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
Network Congestion Solution for FTP Services Based on Distributed Firewall and Snort Andrei-Daniel TUDOSI, Adrian GRAUR, Doru BALAN and Alin POTORAC Department of Computers, Electronics and Automation Stefan cel Mare University of Suceava Suceava, Romania 21th RoEduNet Conference Networking in Education and Research
Table of contents 1. INTRODUCTION 2. CONCEPT ARCHITECTURE 3. UDP FLOOD ATTACK MODEL 4. SOFTWARE USED 5. MEASUREMENT ANALYSIS 6. CONCLUSIONS AND FUTURE WORK 7. ENDING 21th RoEduNet Conference Networking in Education and Research
INTRODUCTION Virtual machine - compute resource that uses software to run programs and deploy apps Hypervisor - creates and runs virtual machines FTP - protocol used for uploading and downloading files UDP - protocol used for communication VSFTPD - FTP server IDS - system that monitors network traffic very high volume of traffic sent to a system so that it cannot examine and allow permitted network traffic Flooding attack 21th RoEduNet Conference Networking in Education and Research
Concept Architecture Distributed Firewall 21th RoEduNet Conference Networking in Education and Research
UDP Flood attack model 21th RoEduNet Conference Networking in Education and Research
Software used LOIC Name Consisting of Operating System CPU (cores) Target IP 172.21.3.100 Timeout 9001 Firewall Port pfSense with Snort FreeBSD 6 20 Method UDP Target Threads VSFTPD Ubuntu 4 1000 Wait for reply Yes Attacker Speed LOIC Windows 10 4 Faster 21th RoEduNet Conference Networking in Education and Research
Snort rule configuration for UDP flood drop udp any any -> $HOME_NET any (msg: "LOIC DDos Flood Attempt in UDP mode"; flags:0; ttl: 128; flow: stateless; detection_filter: track by_dst, count 90000, seconds 60; sid:3; rev:001;) 21th RoEduNet Conference Networking in Education and Research
Differences between transfer duration in different scenarios Differences between average speed in different scenarios 21th RoEduNet Conference Networking in Education and Research
CONCLUSIONS AND FUTURE WORK In this paper, we proposed an optimization for pfSense through a Snort rule to detect and suppress flood on protocol UDP. Our work shows a significant improvement in performance in this kind of attack inside a network. The results demonstrate that our development of Snort rules makes pfSense use less CPU and network bandwidth when UDP flood occurs. The time of file transfer was significant improved with our study, and can be observed in figures presented previously. The entire network security is improved, and the congestion problem is solved. We are hoping that our work can help other researchers in their study and also network administrators from different sectors. As a continuation of our work, we propose as future plans to find a way to manage the manner that pfSense administers traffic logs. Optimizing the process of writing the logs after the target is blocked would improve the CPU usage of pfSense. Virtualized networks have a huge number of benefits because of the low cost of implementation and easy maintenance price. They are flexible, improve control over network traffic, and give businesses scalability and extensibility. 21th RoEduNet Conference Networking in Education and Research
Thank you! 21th RoEduNet Conference Networking in Education and Research
