## 4 Measuring the Effect of the DoS Attack on 3G Networks  
We think paging is a big threat in mobile cellular networks. So, we performed some attacks by exploiting vulnerabilities in GSM network components due to paging, and examined the effect of these attacks. A network or company is as strong as its weakest point in terms of security. Therefore, a network should be assessed as a whole when a security solution is put in place. All pieces of a network should be evaluated carefully in terms of security. We performed DoS and flooding attacks in a production mobile cellular network that supports 120,000 concurrent users and investigated their effect on core network equipment such as the RNC and SGSN. We suggest some countermeasures, taking our findings into consideration. As discussed earlier, some mobile cellular operators think that no security solution is necessary on the Internet border of their network that serves their subscribers during Internet access. So, they typically construct their networks as shown in Figure 7. In this setting, any packet coming from the Internet, destined to a subscriber of the mobile operator, could reach its target. A subscriber accesses core network devices for authentication and authorization, after passing through the air interface and the transport network of the mobile operator. An IP address is assigned to a subscriber by a GGSN if it is successfully authenticated and authorized. The first point on the mobile cellular network where a subscriber can do IP-based communication is the GGSN. The GGSN acts as a remote access server. A subscriber's data traffic is carried via tunnels until the GGSN. For example, the subscriber traffic from the GGSN to the SGSN is carried by GTP tunnels. Briefly, behind the GGSN, the subscriber data traffic is tunneled and carried to the subscriber as shown in Figure 8. Therefore, when any customer tries to learn the traffic path by using trace applications (e.g., tracert for Windows or traceroute for Linux and Unix), they notice that they can see just the GGSN's IP address, and the devices after the GGSN only if the operator allows. Direct access to core network equipment is not allowed by nature of mobile cellular networks. Even then, we think that the traffic from a subscriber to the Internet, and from the Internet to a subscriber, could affect core network devices dramatically. It is a serious threat and a countermeasure needs to be taken. The most practical way to decrease the risks here to an acceptable level, without monetary investment, is to enable the IP filter feature of the used Internet router without a firewall feature. With this feature, a router examines the source and/or destination IP address fields, and possibly also the TCP/UDP port numbers, in a packet's IP header. By controlling the TCP/UDP port number in the IP header, it might achieve more detailed filtering. On the other hand, Access Control Lists (ACLs) consist of IP/TCP/UDP based filtering entries, and they are typically used to indicate the allowed/blocked IP addresses whose traffic is allowed/blocked. This simple countermeasure will protect the core network devices and also the UEs. However, the basic ACLs on the router supports only basic IP/TCP/UDP restriction and does not provide session state tracking or stateful inspection [22] for all the used protocols such as TCP and UDP. Without a stateful firewall feature set, a router can only support TCP SYN attack protection. However, all other attacks with TCP flags, such as ACK, RST/ACK, FIN, FIN/ACK, _etc._, which are set to 1, can pass through a router's ACLs without being blocked. Therefore, a router recognizes any packet coming from the Internet with its SYN bit set to 1. If the packet is not given the access right on the ACL, it will be dropped. Thus, a router can block only the unwanted packets with their TCP SYN bit set to 1. And all other TCP or UDP packets will be allowed in order not to block the response to legal customer initiated traffic. In our study, we call this kind of an ACL as TCP ACL.