DoS

Denial of Service is the exhaustion of resources on a computer or network. Legitimate users will be interrupted from doing their regular tasks and often a loss of monetary resources are involved. Denial of Service can cause stocks to fall and make system administrators nervous.

In order to minimise the effects of a DoS a Firewall can be used as well as creating policies that limit resources to an entity. Most common DoS attacks come in the way of ICMP packets. As per RFC 792 there are several types of ICMP. You may wish to block some. Most people would only leave the two ping types permitted: 0 Echo Reply 3 Destination Unreachable 4 Source Quench 5 Redirect 8 Echo 11 Time Exceeded 12 Parameter Problem 13 Timestamp 14 Timestamp Reply 15 Information Request 16 Information Reply

Some useful detection commands assuming you're using tun0:


 * 1) tcpdump -i tun0 -n icmp
 * 2) netstat -i -p icmp -I tun0

See also Ddos.