# Studying the Impact of Different TCP DoS Attacks on the Parameters of VoIP Streams
## 1 Introduction  
DoS (Denial of Service) attacks are becoming more frequent. These attacks are probably the easiest type of attack to carry out. Any device that has an embedded web server (runs requests) can be affected by a DoS attack as long as it has network functionality--it can connect to IP networks or the Internet. These devices can be various power electronic devices, IoT (Internet of Things) devices, cyberphysical systems, etc. An attack may cause very serious problems and consequences; take, for example, an attack on a power electronic device that is used by a telecommunications operator to remotely control the power supply (PDU--Power-Distribution Unit) of various communication devices (such as routers or switches). The remote switching on/off (hard restart) of the devices, in case of a detected problem with the operator's communication network, would not be possible if the device were to be affected by a DoS attack. As a result of the attack and the inability to remotely reboot the communication device, the telecom operator will begin to suffer losses and customer dissatisfaction will build due to problems with the network caused by an attacked PDU device. Of course, there are different methods and techniques to protect against this type of attack, such as the following:  
* Network segmentation by creating VLANs and using hardware firewalls;
* Load balancing--distributing traffic across multiple servers;
* Blocking traffic from known or suspected IP addresses that have been linked to DoS attacks in the past or present;
* Limiting the speed of the traffic, which can prevent a DoS attack from overloading the server;* Using Content Delivery Networks (CDNs)--this distributes the content of the website across multiple locations; thus, a DoS attack could not bring down the entire site. The consideration of these methods and techniques of protection is not the subject of this work. The aim is to observe what happens to an attacked device during a DoS attack and how the attack affects the performance of the device. It is interesting to perform research aimed at monitoring what happens to the attacked device during a DoS attack in order to study the results of these attacks in more detail [1; 2; 3; 4; 5; 6; 7; 8; 9; 10; 11; 12]. The question everyone would ask is how to implement such a study. Of course, the best option is to create an experimental IP network and to run various tests with DoS attacks on different devices on the network and observe what happens. An even better option is to use a working network wherein the device under study is connected and attacked. However, here, there would be two main problems: first, there is a danger that the attack could get \"out of control\", i.e., affect other working devices, and, secondly, no one would allow such a study on a working network. Therefore, the most convenient way to carry out such studies is through modeling or by using IP network-modeling platforms [13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27; 28; 29; 30]. Through the use of IP network-modeling platforms, several problems are solved:  
* It solves the problem wherein the expensive physical network devices needed for experimental networks are not available;
* The modelled experimental network is completely closed. Thus, studies of different attacks will be 100% controllable and there is no danger of the attacks going outside the controlled area. What is the need for such a study? First, it is interesting to observe if and how different TCP DoS attacks change or influence the parameters of VoIP voice and video streams in some way while the VoIP server is being attacked. Additionally, the study will test whether the studied VoIP server provides any protection from DoS attacks. A question arises as to the importance of studying a VoIP server under DoS attack, as voice traffic is exchanged directly between the IP telephones (software or physical) and is not passed/processed by the VoIP server.