# Studying the Impact of Different TCP DoS Attacks on the Parameters of VoIP Streams
## 3 Modeling Platform, Tools, and Research Methodology Used
### Research Methodology  
As mentioned above, the study is divided into two parts.  
In the first part, only voice traffic is exchanged between the virtual users in the modeled network. The virtual users are implemented using the hypervisor program VMware Workstation Pro 17 [52]. The Windows 10 [53] operating system was installed on these virtual machines. To be able to build VoIP connections between individual Asterisk subscribers, Linphone software for desktop [54] was installed on each of the virtual operating systems. The conversations were grouped into four parts of approximately ten minutes per conversation. During each of the conversations, Kali Linux attacked the Asterisk Free PBX with different TCP DoS attacks: first with TCP SYN flooding; then with TCP ACK flooding; then with TCP RST flooding, and finally with a TCP FIN flooding attack. The size of the packets was set to 900 bytes. This is the maximum packet size that the modeled network devices in the network can process. The inability to process more traffic is due to limitations in the used disk images made by the manufacturers. The packets were sent approximately every 10 \(\upmu\)s.  
In the second part of the study, only video calls were exchanged between two subscribers (because I have only two webcams). The video calls were grouped into four parts of about 10 min per video call. During each of the calls, Kali Linux attacked the Asterisk Free PBX with different TCP DoS attacks: first with TCP SYN flooding; then with TCP ACK flooding; then with TCP RST flooding, and finally with a TCP FIN flooding attack.  
The monitoring was performed using Wireshark, which integrates with GNS3. This functionality makes it possible to observe absolutely all possible links in the modelled network. For the purpose of the study, only the link between Asterisk_Free_PBX and Switch2 was monitored. Only this link was chosen for monitoring because the traffic that is generated by Kali Linux (the various TCP DoS attacks), as well as the voice/video traffic that is exchanged between individual users on the network, passes through this link. As mentioned above, on Asterisk Free PBX, the voice and video traffic pass through the VoIP server, not just between individual subscribers. Because Wireshark was used in both studies, all packets that were exchanged between Asterisk, the virtual users, and the Kali Linux were captured. Once the study was completed, the Wireshark function for studying RTP streams was used to analyze the voice and video streams. Using this function of Wireshark, the observed parameters were analyzed and the impacts of various TCP DoS attacks were evaluated. The parameters observed were jitter values and packet loss.  
During all the calls (voice and video), the round-trip delay (RTD) between each of the virtual users and Asterisk was continuously measured. The purpose of this measurement was to observe what happened to the connection between individual subscribers and Asterisk when the VoIP server was subjected to individual TCP DoS attacks--whether the connection broke down or the delay became too huge to be measured, etc.  
Using the free Colasoft Capsa software, it was possible to monitor the traffic coming in/out of the Asterisk Free PBX network interface in the modelled network. The parameters monitored were the number of individual types of TCP packet and the amount of traffic processed by Asterisk. Monitoring the values of the individual types of TCP packet made it very easy to detect the occurrence of a TCP DoS attack, the occurrence of a successful TCP session, and other events related to this study. The amount of traffic processed showed the total traffic (voice/video traffic as well as TCP DoS flooding) that the VoIP server had processed. This information was used as a visual representation of how much information Asterisk had to process.