Distributed Denial of Service

This page covers Distributed Denial of Service (DDoS) attacks, and the tools used for them, such as Trinoo, TFN, Stacheldraht, and Shaft.

Papers

Interview/article with 01net (in French) about DDoS (April 2002, interview was in late summer 2001).
Analyzing Distributed Denial of Service Tools: The Shaft Case, by Sven Dietrich, Neil Long, and David Dittrich. In Proceedings of USENIX LISA 2000, December 2000. Available in Postscript, gzipped Postscript and PDF formats.
Scalpel, Gauze, and Decompilers: Dissecting Denial of Service (DDoS), by Sven Dietrich. ;login:, Special Issue on Security, November 2000.
The "mstream" distributed denial of service attack tool, by David Dittrich, George Weaver, Sven Dietrich, and Neil Long. May 2000.
Analysis of the ``Shaft'' distributed denial of service tool, by Sven Dietrich, Neil Long, and David Dittrich. March 2000.
- Note: the BugTraq posting has a duplicate line in the code for dds, which is corrected in this version available here on this site.
The CERT Distributed Intruder Tools Workshop Results. Also in PDF format
Dave Dittrich's DDoS page contains several papers pertaining to DDoS.

The CERT Coordination Center in Pittsburgh, PA, USA.
The National Infrastructure Protection Center, in cooperation with the FBI.
The SANS Institute in Baltimore, MD, USA. In particular, you may want to look at the Global Incident Analysis Center page.

Last modified: 15 October 2002