A NOVEL ROUTING PRINCIPLE USING HASH TABLE
-PREVENTING DoS ATTACKS
NAME: Dheeraj.M Name: [Link] chowdary
Year: III year Year: III year
College: SSN College of Engineering, Chennai
ABSTRACT:
The purpose of this paper is to device a new routing principle that can prevent the Denial of service
(Dos) attacks. With this idea, we need not re configure the way routing takes place but add an extra function to
the existing router. This has an added advantage that is this can increase the speed of the routing as well as
reduce the power consumed for the routing process and also it gives way to smoother streaming of videos and
audio.
In the present scenario, every data including video, mail etc., are broken into small packets by the source and
then sent via switches and routers to the destination node. Looking at the function of a conventional router in
this process, for example taking two packets that are received by the router which are a part o the same file, the
ingress router first checks the packet destination address with routing table. Then it holds the packet in the
queue until it is dispatched to its destination. While the router receives the second packet it follows the same set
of steps without knowing that similar packets are routed recently. This consumes a little more time when seen in
a large traffic perspective. Let us consider this as problem one.
Present Scenario: Problem three:
In the present scenario, every data including video, During heavy traffic situations, streaming of the
mail, etc, are broken into small packets by the video and audio which has to be continuous gets
source and then sent via switches and routers to the deteriorated when there is a delay in the order of
destination node. Looking at the function of the few milliseconds. This is because routers treat these
conventional router in this process, for example files as loose data packets while they have to treat
taking two packets that are received by a router them as flow data. Let us consider this as problem
which are a part o the same file, the ingress router three.
first checks the packet’s destination address with
the routing table. Then it holds the packet in a
queue until it is dispatched to its destination. While
the router receives the second packet, it follows the
same set of steps without knowing that a similar
packet was routed recently.
Problem one:
The router simply executes the same routing
principle to all the packets without knowing that
similar packet is routed recently. This consumes a
little more time when seen in large traffic
perspective. Let consider this as problem one.
DoS Attack(Problem two):
Coming to how a DoS attack takes place, a hacker
who wants to overload a server and make it
collapsed or collapse a network router and the
corresponding LAN, one of the methods he uses is
by sending multiple packets to the intended server
or through the victim router to the destination host.
ICMP flooding, peer to peer attacks, DDoS attacks
are based on this kind of technique used by the
attacker. Let us consider this as problem two.
Existing solution for DoS attacks in brief: Solution to Problem one:
We have devised a solution for the above three Considering the problem one, since it routed each
problems, especially DoS attacks, which is more packet separately, it consumed more time. But now,
efficient than the existing solutions. Having an since any packet to the same destination in the hash
overview of the existing methods to resolve the DoS table is dispatched blindly through the same port
attack, the firewalls are effective but sometimes that the first packet was routed without following
they can’t differentiate the normal and DoS traffic. the entire routing principles more time is saved.
The switches and routers also have the rate limiting This gives a solution to our problem one.
and ACL capability which prevents the DoS attack
to some extent compromising with the speed and
complication at layer 2 and 3. The IPS (Instruction
Prevention System) also works for certain kinds of
attacks but not for all kinds of attacks.
Proposed Method:
(solution to problem two):
In our proposed method, we have found an easy
solution to retard the DoS attacks by making use of
the hashing table. Taking the fact that a packet
contains the full identification of the flow it belongs
to, which contains the source address, source port,
destination address, destination port and the
protocol. So, all the packets to the same destination
have the same destination address, port and the
protocol. So in managing the flow, we need to route
only the first packet to the destination and its
destination identifications are stored in the hash
table, a data structure that facilitates a fast look up.
When you encounter a new packet then match that
with the hash table before routing it, if it is present,
then it is supposed to be the part of the flow you
have already routed. Check the number of times the
destination has been charged with packets
regardless of the source, by having a count in the
hash table. If, to any destination, there is too much
flow of packets continuously, then we can diagnose
it as a DoS attack and discard the flow of packets
automatically. Thus we can prevent the DoS attack
to any server without jamming the router and
routing. This gives a solution to our problem two.
Solution to problem three:
Considering the problem three, if traffic gets too
heavy, you’ll still have to discard packets. With our
method, the packets as they’re coming in, you can
track in real time the duration, throughput, bytes
transferred, average packet size, and other metrics
of every flow available in the hash table. Taking a
flow that has a steady throughput, which is the case
with voice and video, you can avoid discarding such
packets, protecting these stream-based
transmissions. For other types of traffic, such as
web browsing, you can selectively discard just
enough packets to achieve specific rates without
stalling those transmissions. This gives a solution to
our problem three.
REFERENCES:
1. [Link]
2. [Link]
3. [Link]
4. CCNA study guide by Todd Lamlle.
5. Computer Networks by Andrew S
Tannenbaum.