Analyze Network Attack

Overview

This repository contains an analysis of a network attack scenario involving a SYN Flood attack. The attack disrupted a travel agency's website by overwhelming the web server with a high volume of TCP SYN requests, leading to a denial of service for legitimate users. The goal of this analysis is to identify the attack, understand its impact, and suggest mitigation strategies.

Scenario

As a security analyst for a travel agency, an automated alert indicated a problem with the web server. Upon investigation using a packet sniffer, a large number of TCP SYN requests from an unfamiliar IP address were detected. The web server was overwhelmed, leading to a connection timeout error for legitimate users. Temporary mitigation steps included taking the server offline to recover and blocking the malicious IP on the firewall.

Tools Used

• Wireshark: Used to capture and analyze network traffic, identifying abnormal patterns and detecting malicious activity.

Attack Details

Type of Attack: SYN Flood (Denial of Service - DoS)

A SYN Flood attack exploits the TCP three-way handshake by sending a large number of SYN packets without completing the handshake, which exhausts the server’s resources and prevents legitimate connections.

Impact of the Attack

• Website downtime resulting in HTTP 504 Gateway Timeout errors
• Server resource exhaustion, leading to degraded performance
• Disrupted access for employees and customers

Steps Taken for Analysis

1. Captured network traffic using Wireshark
2. Identified excessive TCP SYN requests from a single IP
3. Analyzed logs to confirm the attack pattern
4. Temporarily took the server offline to recover
5. Blocked the attacking IP via firewall rules
6. Prepared a report for management on the incident

How to Use

1. Install Wireshark and capture network packets during an attack simulation.
2. Analyze the traffic for unusual SYN request patterns.
3. Implement mitigation strategies based on the findings.