Some NS-2 code to simulate DoS and DDoS attacks

This is some basic TCL code that used for some simulations. This code works on the NS-2 network simulator.

Simple simulation with flow monitors. It creates 4 nodes: 1 UDP source and 1 TCP source (FTP), 1 destination node and 1 transit node. It monitors the flows coming in and out from the queue in the link between the transit and destination node. It dumps the trace data to a flow file.

Ping Flood . It creates two nodes. Node 1 floods ping packets to Node 2. It could be useful to simulate Denial of Service attacks.

Simple DoS Attack. It creates a topology of 7 nodes. Two nodes generate valid traffic (one UDP and another TCP in the form of FTP). Another node generates and UDP DoS.

TCP monitoring in NS

Today I was asking in how to monitor TCP connections on NS-2. Then I decided to blog about the topic.

First you need a TCP agent and maybe with a FTP or some sort of application (I suppose that you already have some nodes):

#Setup a TCP connection set tcp1 [new Agent/TCP]
$tcp1 set class_ 2
#Attach tcp to node n0 $ns attach-agent $n0
$tcp1 set sink [new Agent/TCPSink]
#Attach a sink to node
n1 $ns attach-agent $n1 $sink $ns connect $tcp1 $sink
$tcp1 set fid_ 1
#Setup a FTP over TCP connection
set ftp0 [new Application/FTP]
#Link tcp agent with FTP application
$ftp0 attach-agent
$tcp1 $ftp0 set type_ FTP

Now, create a procedure to print some TCP information

proc update_tcpinfo {} {
global ns file_out time_step
set now [$ns now]
set window [$tcp set cwnd_]
set avgwind [$tcp set awnd_]
set rtt [$tcp set rtt_]
set acks [$tcp set ack_]

Then you have window, avgwind, rtt and acks that you can print out to screen or to a file (an output file or may be the tracefile, I would recommend a separate trace file).

puts $file_out "$now $window $avgwind $rtt $acks"

And call the procedure every time_step

$ns at [expr $now + $time_step] "update_tcpinfo" }

To declare your outfile just do it as the trace and nam files are normally initiated:

#Open flow file set file_out [open flow_trace.txt w]

And do not forget to close it:
#Define a 'finish' procedure
proc finish {} {
global ns nf tf file_out
$ns flush-trace
#Close the NAM trace file
close $nf

#Close the Trace file
close $tf
#Close outputs file
close $file_out
#Execute NAM on the trace file, uncomment the next line to exec NAM automatically
#exec nam out.nam & exit 0
}


Call the procedure and run the simulation

$ns at 0.5 "updatetcpinfo" #Call the finish procedure after 5 seconds of simulation time $ns at 5 "finish" #Run the simulation $ns run

This is only pseudo code and it could have some errors. I prepared a working file that can be found here:

NS-2 Memory exhaustion

1078404057

I recently started to run a big simulation (68 agents and nodes) in NS-2 to test my intrusion detection algorithm using reinforcement learning. When I ran the simulation for more than x time, it started freezing the host and it ended killing the process. I look for errors in the code and nothing. I freed some disk space thinking that it could be that the log files were using all the available space. It worked a little until I ran the configuration x + y time.


I suspect about memory use and I increase the memory in the host machine (I was using vmware, so it was easy) with good results. However, as I increased the simulation time the solution became and endless cycle (that will end in no more memory available in the machine hosting the vmware). I started looking for problems in how I was using the memory in my code. I found some links about how to debug memory allocations in NS. I must say that I could not make them work, any way the links are here:


NS-2 debugging tips
dmalloc


Of course I sent an e-mail to the ns-users e-mail list, and as always it was useless (it seems that anybody likes to answer smart questions and newbies always post dumb ones -that no body replies either -). After reading the ns-manual again, I found that I could (or I must I am not sure) free the packets that I used. It is that I developed a new type of agent. The interaction and information shared between agents is of course through special packets that I define.


So, the call is:


Packet::free(pkt);

I call it in the method that receives the packet just after reading the packet data that I need:

void RL_MAgent::recv(Packet* pkt, Handler*)
{
// Access the IP packet
hdr_ip *iph = hdr_ip::access(pkt);
// Access the RL header for the received packet:
hdr_rl* hdr = hdr_rl::access(pkt);
double stime = hdr->send_time_;
int ptype_ = hdr->p_type_;
int nodeid_ = hdr->node_id_;
int src = iph->saddr();
int dest = iph->daddr();
int srcport = iph->sport();
float now_ = Scheduler::instance().clock();
Packet::free(pkt);

if (ptype_ == T_START)
{ ...

As result, my simulation only needs around of a steady 10MB of memory to run.