TFN2K
¨Successor to Tribe Flood Network
¨Allows attacker to command zombies to launch various attacks
–Targa (malformed packet DoS attack
–UDP flood
–SYN flood
–ICMP flood
–Smurf attack
–“Mix” attack using UDP, SYN, and ICMP floods
¨Communication from client to zombies uses ICMP Echo Reply packets
¨Zombies not detectable via Nmap
¨Clients and zombies can spoof source IP address
¨Very difficult to find attacker