How DDoS Attack Effect Voice Quality on IP QoS Network

Transcription

1 How DDoS Attack Effect Voice Quality on IP QoS Network CS4558 Project Kavurucu, Yusuf Koca, Burak Son, Yong Ik

2 Our Motivation Is it possible to make Denial of Service Attack against QoS (Quality of Service) enabled network? We couldn t find related study about this topic (Specif ically attack against QoS enabled network) We conducted an experiment, we made attack by diffe rent packet types over VoIP traffic. Our aim is to see how VoIP traffic effected by different types of attacks, and draw a conclusion.

3 Introduction(1/4) In our environment we set Quality of Service (QoS) that gives priority to VoIP packets in a shared data network. Typically VoIP traffic includes call signals, uses SIP (S ession Initiation Protocol) or digitized audio such as R TP (Real-time Transfer Protocol). These protocols use DSCP field (Differentiated Services Code Point) in IP h eader to mark VoIP packets high importance.

4 What is DSCP field? Introduction(2/4) 4

5 Introduction(3/4) When the IP network supports QoS, EF traffic is classifi ed into the highest priority queue and BE is moved into the lowest priority queue. Normally, non-voice traffic should not effect voice traffic quality in IP QoS enabled network. This is because "EF" labeled traffic have priority over regular traffic with traffic prioritization and scheduling enabled. As DDOS packets are not marked with the highest priori ty, VoIP service will not be affected even though DDOS attacks happen. However, if the DDOS packets are marked with EF, voic e traffic will be also affected.

6 Introduction(4/4) We used 4 type of packets to attack VoIP traffic h are: TCP UDP EF marked TCP EF marked UDP whic We got results from these perspective: Lost Packets Fraction Loss MOS /Quality of Voice PDV /Latency of Packets Jitter /Gaps Between Packets

7 Methodology & Tools Methodology: Assign 2 classes on the router. Generate 4 types of packets based on the DSCP marking. Establish calls between the phones. Compare voice quality with each attack type. Router Router IP Phone PC IP Phone PC Tools: Emulator: GNS3, Vmware. Packet generator: Iperf (with DSCP packet option) IP Phone: Twinkle (Softphone) VoIP packet analyzer : VoIP monitor

8 Tool(1/3) GNS / /24 Iperf Client Twinkle Iperf Server Twinkle

9 Tool(2/3) GNS3 Configure(QoS) class-map match-any Realtime Description Realtime and Interactive Apps Match dscp ef Match dscp cs5 policy-map VoIP_Child class Realtime priority police set cos 5 class class-default set cos 0 ---> (100 Mbps) policy-map VoIP class class-default shape average percent >(100%) service-policy VoIP_Child interface GigabitEthernet3/23 ---> gigabit interface service-policy output VoIP

10 Tool(3/3) VoIPmonitor We can analyze a QoS of VoIP communication - MOS, Fraction Loss, Jitter, PDV

11 1. VoIP connection Action 2. DDoS (10 session * 10Mbps) -UDP, TCP -DSCP marked UDP, TCP Iperf Client Twinkle Iperf Server Twinkle 3. QoS Check

12 Result (Fraction Loss) UDP TCP DSCP-UDP DSCP-TCP Fraction Loss * Fraction lost : the number of packets lost divided by the number of packets expected UDP TCP DSCP-UDP DSCP-TCP

13 Result (MOS) UDP TCP DSCP-UDP DSCP-TCP MOS Mean opinion score (MOS) is a test that has been used for decades in telephony networks to obtain the human user's view of the quality of the network. MOS Quality Impairment 5 Excellent Imperceptible 4 Good Perceptible but not annoying 3 Fair Slightly annoying 2 Poor Annoying 1 Bad Very annoying We transforms PDV and Packet loss into MOS score according to ITU-T E-model which means that the MOS does not represent audio signal but network parameters.

14 Result (Packet Delay Variation) UDP TCP DSCP-UDP DSCP-TCP PDV "Variance among end to end delays for voice packets received by this node. End to end delay for a voice packet is measured from the time it is created to the time it is received. " The delay is specified from the start of the packet being transmitted at the source to the end of the packet being received at the destination. A component of the delay which does not vary from packet to packet can be ignored

15 Result (Jitter) UDP TCP DSCP-UDP DSCP-TCP Jitter Jitter is all about the timing and the sequence of the arriving RTP packets. If they arrive in bursts interspersed with gaps, or if they arrive out of sequence, then you have high jitter. Jitter happens because it has to share network capacity with other data.

16 Result (Summary) UDP TCP DSCP-UDP DSCP-TCP Received Packed Lost Packet Fraction of Loss MOS PDV Jitter * PDV : The delay is specified from the start of the packet being transmitted at the source to the end of the packet being received at the destination. * Fraction loss : the number of packets lost divided by the number of packets expected (according to the highest sequence number received) since last receiver report. * Mean opinion score (MOS) is a test that has been used for decades in telephonnetworks to obtain the human user's view of the quality of the network

17 Conclusion and Suggestions for Future Research DSCP-UDP made more packet losses that DSCP-TCP, S o it ruin the quality of communication. (Most Packet los s) However, the delay of the communication was severe w hen we tested by DSCP-TCP. DSCP marked DDoS attack clearly shows that it made V oip communications impossible. Also, non-dscp marked DDoS attack debased the quali ty of VoIP communication.

18 Conclusion and Suggestions for Future Research Conclusion: Our study showed that QoS couldn t provide ass urance for VoIP traffic. It is exploited with the EF marked IP packets. As a future research, a method needs to be deve loped to protect QoS networks from DSCP mark ed DDoS attack.

19 References Rich Macfarlane, Adding Virtual Machines to the GNS3Topology,2013 An Evaluation of Secure Real-Time Transport Protocol (SRTP) Performance for VoIP, NSS '09. Third International Conference on Alexander Jin Heo, Voice over IP (VoIP) Performance Evaluation on VMware vsphere, TECHNICAL WHITEPAPER, 2011 VMware vsphere 4.1 Networking Performance. VMware, Inc., Packet Loss, A reference guide to all things VOIP. Voip-Info.org, Quality of Service Design Overview. Cisco Press, Schulzrinne, H., S. Casner, R. Frederick, and V. Jacobson. RTP: A Transport Protocol for Real-Time Applications. The Internet Society,