Demystifying and Rate Limiting ICMP hosted DoS/DDoS Flooding Attacks with Attack Productivity Analysis

Most attractive and easy to operate ICMP based DoS/DDoS attacks are amplification attacks. Permitting ICMP traffic in a conservative manner will help defending the flooding attacks. Existing methods try to control the ICMP traffic with bandwidth limitation, sometimes the limitation is prodigal and in other cases the limitation is stringent which denies the ICMP traffic completely even the vital usage. However the usage of ICMP over the Internet is necessary, therefore in this paper we identify the harmless rate at which the ICMP traffic can be generated and resounded over the Internet. This harmless rate is achieved through ICMP window restriction scheme. We analyze and prove that the window restriction will remove the attack productivity region from the ICMP traffic and promotes only genuine traffic, thus helps to neutralize the flooding attacks. ICMP window restriction scheme therefore overcomes the issues concerning the unfair vertical limitation in bandwidth.