AT21: Media Data Flood
Definition
In addition to VoIP Floods, UDP Floods can take the form of any media data, causing a Media Data flood (Video, Audio, etc.). During an attack, a victim server receives spoofed Media Data packets at a very high packet rate and with a very large source IP range. The victim server is overwhelmed by the large number of incoming Media Data packets, consuming network resources and available bandwidth until the network shuts down. Similar to VoIP floods, Media Data floods can overwhelm a network with packets containing randomized or fixed Source IP addresses, making the attack difficult to identify because it resembles good traffic. Both modes of Media Data floods can easily exhaust network bandwidth as well as CPU resources.
Attack Matrix Dimensions
| Nature of IP | Handshake | Source IP Range | Packet Rate | Packet Size | Packet Content | Fragmenting | Session Rate | Session Duration | VERB Rate |
|---|---|---|---|---|---|---|---|---|---|
| Spoofed | -- | Very Large | Very High | Moderate | Valid | -- | -- | -- | -- |
Configuration Settings
Click Edit to change default setting(s). When done, remember to Save before moving on to next mitigation section.
| Feature | Default Setting | Comments |
|---|---|---|
| Filter Mode | Auto (Auto/Monitor) | Auto: Algorithms are executed and packets are filtered. Monitor: Packets are viewed, counted and all algorithms are executed. No filtering of these packets will occur Monitor mode. DDoS traffic will be identified and represented in all attack-based charts and the Zone Traffic Chart will represent zero dropped traffic. Off: No filtering or monitoring is performed. |