Perform a NTP DDoS attack in your own virtual network. To attempt the attack, you should first try the Ping flooding DDoS attack, setting up the eight nodes as per the ping attack instructions (the step of Ping to Entire Network using Directed Broadcast is not necessary). Then using the same nodes/setup, perform a NTP DDoS attack. Follow the NTP attack instructions to setup the NTP servers and start the attack with ntprepeat.

You must perform the attacks inside a virtual network using virtnet. You should already have this setup from previous homeworks. The attacks require 8 nodes, which may about 1.2GB of RAM. If your computer only has 2GB of RAM, then it may not be possible to create and run the 8 nodes. I suggest using a computer with at least 4GB of RAM. You may use the Apple iMACs in the 3rd floor IT Lab (they have 8GB of RAM). They already have virtnet installed, so you should be able to immediately create the topology.

The NTP DDoS attack is an amplification attack. Therefore in your attack you should try to amplify the data sent to the target as much as possible within the given topology (that is, if the malicious node sends 10 kb/s but the target receives 50 kb/s, then the data has been amplified by a factor of 5). Don't use broadcast - use the ntprepeat script I provide.

Although you may discuss and work with others in understanding and setting up the attack, try to do the attack yourself. To measure how good the attack is, you need to measure the data being generated by the malicious node and the data arriving at the bottleneck link. Specifically, the incoming rate in kbit/sec to eth1 on node 2 and the incoming rate in kbit/sec to eth1 on node 7. You can measure these values by running iptraf on both node 2 and node 7 - select Detailed interface statistics and then interface eth1. Look at the Incoming rates value.

Submission is a single image (PNG or JPG) which is a screenshot showing iptraf running on both node 2 and node 7. The screenshot should be taken when the attack is running and should show the typical rates you observe during the attack (i.e. if the attack runs for 60 seconds, then take the screenshot after about 30 seconds). An example is below, where you can see iptraf running on both node 2 and node 7. Node 2 is receiving 15.0 kb/s from the malicious node, while node 7 is receiving 36.7 kb/s from reflectors to be sent to the target.

I may give a reward to those that produce impressive results.

Results and Feedback

I've collected the results from all those submitted and summarised in the table below. Focus on the TxRate (generated by malicious node 1) and RxRate (received at router to targets network). The NTP attack is an amplification attack - the last column shows the ratio of RxRate to TxRate, in descending order. One the results from my own test is included (screenshot is below). The top two results, by Kraisaek and Noppawat, are amazing (so amazing that I doubt they are accurate). If those two students can successfully explain how they got such high amplification to me then the are worthy of a reward. Later I will explain how I increased the amplification.