Improve the Capabilities of Wireshark as a Tool for Intrusion Detection in DOS Attacks

Jul 14, 2026

Upload by Violet

Wireshark is improved for intrusion detection in DoS flooding attacks, focusing on ping flood scenarios. The work simulates ping flooding using the OS ping command while analyzing Wireshark traffic to count acknowledged ping packets within a time period and compare them against a detection threshold. It discusses Wireshark operation and limitations, and introduces a traceback mechanism to enhance handling when a single port receives all requests.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

International Journal of Scientific and Research Publications, Volume 6, Issue 4, April 2016 378 ISSN 2250-3153 Improve the Capabilities of Wireshark as a tool for Intrusion Detection in DOS Attacks S.Pavithirakini,D.D.M.M.Bandara, C.N.Gunawardhana, K.K.S.Perera, B.G.M.M.Abeyrathne, Dhishan Dhammearatchi Sri Lanka Institute of Information Technology Computing Pvt.Ltd Abstract- Network anomaly detection is a important and dynamic research area. Signal processing techniques have been applied recently for analyzing and detect network anomalies due to their potential to find novel or unknown intrusions. Flooding is a kind of attack, in which the attacker sends several floods of packets to the victim or associated service in an effort to bring down the system. There are unlike types of flooding attacks like ping flood, Syn floods, UDP (User Datagram Protocols) floods etc. The project simulates a ping flood scenario, by using the ping command on the OS(Operating System) and same time wireshark is installing the system on the victim, which would be used to analyses the number of ping packets acknowledged during a specified period with orientation to a threshold, based on which a flooding attack is detected. In wireshark one port received all ping request. Therefore is not accurate to handle the all request. In this paper briefly disused how is wireshark tool working, wireshark tool disadvantages use traceback mechanism and improved the wireshark tool. Index Terms- Hardware, Software, Operating Systems, Windows, Linux, Switch, Wireshark, flooding attack, anomaly detection I. INTRODUCTION ADenial of Service (DoS) attack is a way computers resources unavailable to its user. of making It comes in many different ways and sub motifs. If the hacker carefully planned and execute the attack that the computer and the networks might disable. There are some ways of executing DoS attacks. Flooding the network to prevent legitimate network traffic; Disrupting the connection between two machines, thus preventing access to a service; Preventing particular individuals from accessing a service; Disrupting a service to a specific system or individual; Disrupting the state of information, such resetting of TCP sessions. Ping flooding is the most primitive form of DoS attack. Therefore anyone can do ping attack very easily. When the targeted computer is under ping flood attack what happens is the computer’s network become backed up, trying to keep up with ping requests. Whenever the server gets a ping call for computer has to compute it then send reply with the same amount of data, ping flooding is when the attacker floods the server with ping needs and the server has to calculate tons of requests every split of second , which takes up a lot of resources. In ping flooding attack uses ping which is a simple application that the source send ICMP request to some destination computer and the normal behavior is that the destination to replies with t

Jul 14, 2026

Upload by Violet