Recently I set up 2 virtual machines with Mint 18 inside, to practice and analyze some DDoS attack types. For now on, I'm using hping3
to perform some simple DDoS (or I should say, DoS attacks, since there's only one VM against another).
I read a lot about hping3
and know how to make a regular syn flood:
sudo hping3 -S --flood x.x.x.x
(I don't need the --tcp
option, because I read it's a default setting).
To make a spoofed syn flood, I simply need some random, fake IP source addresses. So far, so easy: sudo hping3 -S --flood --rand-source x.x.x.x
.
However, I read somewhere online, that to make a spoofed syn flood, I need some extra parameters: -P -U
. I did hping3 -h
and saw:
-P --push set PUSH flag
-U --urg set URG flag
So it seems a 'real' spoofed syn flood should look like this: sudo hping3 -S -P -U --flood --rand-source x.x.x.x
But I don't really understand:
- Why do I need these flags?
- What's more important, what's their purpose?
- Why do I not need them in 'standard' flood?
Thank you.