ICMP attacks can be detected from packet payload. Usually Denial of Service attacks
Packet Captures is fundamental for any attack detection. As the saying goes , "If there is no pcap, it did not happen !" . So any intrusion detection paper would need pcaps !
the link below can be useful for you:
http://cstar.iiit.ac.in/~kkishore/pcnad-icadiwt.pdf
and read "Metasploit- David Kennedy" book.
Using packet payload , you can detect DOS attack as well as some probe attacks. Some variation of flood attacks are detected using it.
Live backdoor attack, if you log the payload data, you can identify the backdoor that occurred earlier.
Packet payloads are also used to verify an attack, even if discovered by other means. If you have the full packet capture, you can verify what the attack is, even if it's encoded or obfuscated to bypass defensive mechanisms.
- Badges
- Science topic
- Similar topics
- Computer Communications (Networks)
- Simulators