Avoid any ASUS routers unless you're flashing a new firmware. Awful experience. My last one was the N15. It wouldn't even give out a DHCP lease to two different computers and four different NICs.
And, as for:
"Ever sat in an internet shop, a hotel room or lobby, a local hotspot, and wondered why you can't access your email? Unknown to you, the guy in the next room or at the next table is hogging the internet bandwidth to download the Lord Of The Rings Special Extended Edition in 1080p HDTV format."
Nmap is your friend. Find the offending port and flood it. Since the local connection is always quicker than the Internet connection, it's easy to do. I've done this countless times, and only to those torrenting. At one cafe I use to frequent I would just start scanning whenever this one guy came in. I wonder if he ever developed a negative Pavlovian response to seeing me at the cafe and his torrenting success.
Do I feel guilty about basically DoS? Really, no. If someone tries to take control of a limited resource... shit is going to happen.
They are probably not trying to "take control of a limited resource". Most people don't think of bandwidth in that way.
I sometimes use the shared wifi on trains and overhear people who are confused as to why they can view webpages but 1080p video doesn't seem to stream very well.
>Running Linux? Avoid any ASUS routers unless you're flashing a new firmware.
Good to know, thanks, thought that was what the entire article was about - buy a commodity router (or hardware in general) and flash it with new and better firmware.
nmap is smart enough to determine what service is being offered on a given port and what OS is running.
The above combined with the offending computer usually being a Mac and it's named something like "Bob Smith's Computer" is enough to common-sense narrow it down within a minute or two without having to use passive mode.
(Also with the repeat offender I kept his MAC handy.)
Then just initiate as many TCP connections as you can a la Python or whatever is handy.
(of course your mileage may vary with this approach such as when clients are isolated from communicating with each other.)
Won't the program listening on the socket just drop the connection if it's getting stuff that doesn't make sense or correspond to a session that it is aware of?
It sounds more like connection flooding to me. TCP SYN flooding would also work, although modern IP stacks should cope reasonably well with that if syncookies are used.
That said ... considering these are Macs, they probably have mDNS open to IPv6 link-local traffic. It might make more sense to flood the offending machine with valid, unicasted mDNS packets. I don't know how well the Apple mDNS daemon copes with high traffic volume, but in my experience Avahi (on an Atom-powered netbook, admittedly) can regularly use over 50% CPU on a wireless network with an oversized local subnet. Hypothetically, deliberately flooding an OS X system with complex but valid mDNS announcements could have interesting results...
I should probably point out that Windows systems tend to be protected from this. Firstly, iTunes or Bonjour must be installed separately. Secondly, Windows Firewall tends to kick in with its "Public" profile, blocking inbound traffic by default. Thirdly, Windows machines tend to use mDNS over IPv4 multicast instead of IPv6 unless an auto-configured external address exists. This further reduces the traffic seen, although this last point is no protection from deliberate floods.
Or just offer to help the coffeeshop owner replace their router with something better. I replaced the router at my coffeeshop. They're happy to have the help!
I can't comment on the N15, which is a low end router; however the more powerful ASUS routers are great, I have both a rt-n56u (now with my in-laws), and a rt-n66u, and they both work spiffingly.
Also, check out the reviews on smallnetbuilder etc, they have excellent ratings for these two routers, with the most high recommendations for both.
There's no need to rubbish the whole range of ASUS routers :)
Thanks for sharing. I did not have the same prejudices against Asus' other products, but I did for their routers. (Twice bitten anecdotal evidence re: routers)
I'm seeing more hotels' providers go to private VLANs so in those cases I can't see how such a DoS attack will work any longer. Hopefully, if the provider is sophisticated enough to set up a private VLAN for each room or WiFi connection, they can write the rules for enforcing QoS on the uplink.
Avoid any ASUS routers unless you're flashing a new firmware. Awful experience. My last one was the N15. It wouldn't even give out a DHCP lease to two different computers and four different NICs.
And, as for:
"Ever sat in an internet shop, a hotel room or lobby, a local hotspot, and wondered why you can't access your email? Unknown to you, the guy in the next room or at the next table is hogging the internet bandwidth to download the Lord Of The Rings Special Extended Edition in 1080p HDTV format."
Nmap is your friend. Find the offending port and flood it. Since the local connection is always quicker than the Internet connection, it's easy to do. I've done this countless times, and only to those torrenting. At one cafe I use to frequent I would just start scanning whenever this one guy came in. I wonder if he ever developed a negative Pavlovian response to seeing me at the cafe and his torrenting success.
Do I feel guilty about basically DoS? Really, no. If someone tries to take control of a limited resource... shit is going to happen.