i have to simulate DDoS and DoS in ns2 using TCP ...and then have to genrate the graph using xgraph....i want to check the packet loss...acknowledgements...bandwidth and delays........at specific time interval.......how i can do this...????
what i have done yet is that i have simulated the DDoS but dnt know how to generate these different graphs and how to do their analysis...
Any idea.........i am using NS2 for the first time......Thanks in Advance...

Hi Hinatariq,

Its past 3 months I'm learning the NS-2 tool. Since, my project is also based on simulation of DDoS attacks and traceback of the attack origin.To get the graphs, you need to write AWK scripts and redirect it to a graph within the AWK script.
e.g 1)ns test.tcl
2)awk -f losspackets.awk out.tr
3)xgraph graph1
You'll get the xgraph named graph1.
Browse the net for awk scripts and modify according to your requirements.
Its difficult to understand the flow of NS-2 in the beginning. Its necessary to understand the of the NS-2 trace file format for plotting of graphs according to your requirement. Trace file is nothing but the raw data from which you can calculate values that is to be written in AWK script and plot graphs accordingly.
Regards,
rohiinii

1 members found this post helpful.

Hi


There are different ways to plot graph of trace files. you can use tcl language in your simulation code, awk for extracting data from trace files and compiling graphs, can use perl for extracting, using tcl in your simulation code is better choice then using awk or perl coz you have to learn another language awk or perl. so try to use tcl in your simulations for ploting graphs. i am also wandering for help for this issue

hope for the best.

regards

Try browsing the net for awk scripts and modify according to your needs.
It may be hard to figure out the flow of NS-2 in the beginning But it's necessary to understand the of the trace file format for plotting NS2 graphs per your needs. A trace file is just raw data from which you calculate values that is to be written in AWK script and plot graphs accordingly. Hope this helps...

Example, awk ... line 101 here
http://spectral.mscs.mu.edu/Net2008I...TML/node2.html

And Google .. ns2 display out.tr .. ( 1,000,000 hits ) Example :
http://nile.wpi.edu/NS/example_srm.html

..

hi, hinatariq, I'm using NS-2 for the first time right now..

and I see that u have simulated the DDoS attack on NS2, could you please share it with me..? because currently I'm having problem trying to simulate the similar case..

thanks b4.. =)

note: u could email me at yoh_khos@yahoo.co.id

Hi all,
I have to demonstrate a simulation of DDOS in NS2. Can you guide me? Anticipating for your response urgent

Post #7 , @ asif_ali_azad : Welcome to LQ.

Suggest : Google .. DDOS in NS2 ..
http://www.google.com/webhp#hl=da&so...99a9b071bc104a

Example :
http://en.cnki.com.cn/Article_en/CJF...Z201003013.htm

.. + another 29,000 hits.
..

The Active Queue Management and Denial-of-Service (AQM&DoS) Simulation Platform can simulate a variety of DoS attacks (Distributed DoS, Spoofing DoS, Low-rate DoS, etc.) and Active Queue Management (AQM) algorithms (RED, RRED, SFB, etc.). It automatically calculate and record the average throughput of normal TCP flows before and after DoS attacks to facilitate the analysis of the impact of DoS attacks on normal TCP flows and AQM algorithms.More Details.

2 members found this post helpful.

post 7 @ mleoking
i have installed ns2.32 on fedora 11
where as the recommended AQM&DoS simulatino platform is the ns-allinone-2.33 operation system (Debian 4.0 Linux ).

would the above simulation platform work for me
i am currently trying to simulate DDoS attack using different queueing schemes

I think it works for ns-2.32. There is no many differences between ns-2.32 and ns-2.33. Debian 4.0 is not a must either.

AQM&DoS platform is just what you want: DDoS attacks with different queuing schemes.

Hope you successively install and use it.

I think it works for ns-2.32. There is no many differences between ns-2.32 and ns-2.33. Debian 4.0 is not a must either.

AQM&DoS platform is just what you want: DDoS attacks with different queuing schemes.

Hope you successively install and use it.

2 members found this post helpful.

@ mleoking
when i tried to change queue type by changeing the value of bn_qm in leodosh.sh to 2, 3, 4
it show me bn_qms DropTail for every change while executing
also tell me how to change tcp data of legetimate user to udp
also tell me how to find nam and trace file

1 members found this post helpful.

There are a variety of ways to run the simulation on the AQM&DoS simulation platform, but the recommended way is to use the leodos.sh to launch the simulation rather than execute "ns leodos.tcl" directly (this is relevant to your second question as well). To execute the leodos.sh you need to change its mode to be executable by using the following command:

chmod +x leodos.sh

and run it using:

./leodos.sh

The parameters in the head of the leodos.sh file are only the default parameters to run the simulation. These parameters could be modified by following lines of code. In the original leodos.sh file, these two lines of code

task_aqm_ldos 2; #RED
task_aqm_ldos 15; #Roubust RED

rum a batch of simulations on RED and RRED queuing scheme. task_aqm_ldos is a function, in which the default parameters of the simulation are modified. If you just want to conduct one simulation using the parameters specified in the head of this file "leodos.sh", you can add the following line of code to the end of leodos.sh:

dosim 0;

and add a # before task_aqm_ldos 2; and task_aqm_ldos 15; to inactive these two batch of simulations. You can learn to modify the code of the function task_aqm_ldos to run your own batch of simulations in the future as this will save you lots of time.

Normally the AQM&DoS simulation platform experiments on legitimate users using TCP protocol as TCP is more likely to be affected by DoS attacks and queuing schemes (AQM) rather than UDP. But if you do want to simulate UDP users, you can modify the file "leodos.tcl" in the following ways:

1. Replace "set agUsrSend($i) [new Agent/TCP/Newreno]" with "set agUsrSend($i) [new Agent/UDP]"
2. Replace "set apUsrSend($i) [new Application/FTP]" with "set apUsrSend($i) [new Application/Traffic/CBR]"
3. Replace "set apUsrSend($i) [new Application/Telnet]" with "set apUsrSend($i) [new Application/Traffic/Exponential]"
4. Add the following lines of code after "$agUsrSend($i) set packetSize_ $pam(ur_ps)":

if { $pam(ur_app)==0} {
$apUsrSend($i) set burst_time_ 500ms
$apUsrSend($i) set idle_time_ 500ms
$apUsrSend($i) set rate_ 100k
}
if { $pam(ur_app)==1} {
$apUsrSend($i) set rate_ 64Kb
$apUsrSend($i) set random_ 1
}


The above code is setting parameters for UDP traffic applications (CBR/Exponential). If you have no idea of CBR/Exponential, please refer to the following links:

CBR: http://www.isi.edu/nsnam/ns/doc/node508.html
Exponential: http://www.isi.edu/nsnam/ns/doc/node506.html

The parameter ns_of in leodos.sh is about the out files.

When ns_of:
>=3 output leodos.nam (used for nsnam to figure the simulation topology)
>=2 output leodos.tr leodos_tcp.tr leodos_queue_monitor.tr
>=1 output leodos_queue.tr (The data trace of the bottleneck queue. It is the primary analysis data source for this simulation platform)

The default value of ns_of is 2, so that it only output trace files (leodos.tr, leodos_tcp.tr, leodos_queue_monitor.tr, leodos_queue.tr). If you want to output the nam file "leodos.nam", you need to change ns_of to 3.

These output files are located in the sub-directory "result" under "aqm-dos-sim-plat"


To solve the warning:

Add the following lines to the end of ns-default.tcl ("ns-allinone-2.33\ns-2.33\tcl\lib\ns-default.tcl").
# Added by leoking spoof config 0
Agent/TCP set saddr_min 1
Agent/TCP set saddr_max 100
Agent/TCP set spoof_level 0

Agent/UDP set saddr_min 1
Agent/UDP set saddr_max 100
Agent/UDP set spoof_level 0
# Added by leoking spoof config 1

You need to modify the parameters in leodos.sh and use it to launch the simulation rather than execute "ns leodos.tcl" directly. (There are detailed explanations for how to run leodos.sh in the beginning of this thread)

According to the warnings, you also need to double check whether you have strictly followed the instructions in "integration-of-ip-spoofing.txt".

Another thing you need to check is whether you have installed AWK properly, which is a part of the ns-allinone distribution, using the command: awk

If there the following message appears:

awk: command not found

it means that you have not installed AWK. Otherwise, you have already installed it.

2 members found this post helpful.

respected Sir,
need help to install awk

1 members found this post helpful.