CCIE Security Practice Labs

Section 10.0: Security Violations (8 points)

10.1. DoS Attack (4 points)

1. A web server was attacked on the network.

2. The nature of the attack could not be characterized.

3. Sniffing data collected is the only forensic evidence available to determine the nature of the attack.

4. Assume R7-Loopback1 (77.77.77.77) is the web server in this question.

5. Analyze the sniffer captures provided in Figures 6-5a through 6-5d and characterize the attack. Determine the best possible method to prevent such an attack in the future.

   Figure 6-5a. Attack Sniff Capture 1

   

   Figure 6-5d. Attack Sniff Capture 4

6. Note the attack is from a random source IP. You cannot configure ACL or ...