Hello all. We ran a DDOS scenario in class today. One port of a 2960 (100mb full duplex) hosted a simple web server with about 3 mb of graphics. Private network - no internet connectivity.
We pointed about 30 PC's at the IP address of the Web Server and used 2 tools. Hyena - TCP focused on port 80 and multiple DOS prompts with the following command ping 192.168.1.30 -l 65500 -w 1 -n 1 -t
We had perfmon running on the web server and could never drive it past about 30% utilization. We would get lots of destination host unreachable but the web page would still load. We used incognito web browsing to bypass caching.
It actually surprised me that the web page would still load when the destination host unreachable message started happening.
We finally got the web page to quit loading by changing the web server port by setting it to 10mb/half duplex.
How much more horse power would I need to stop the web server from loading the page under a 100mb/full duplex situation? Or is there something about a 100mb/full duplex keeping it from getting totally saturated ?
