# Studying the Impact of Different TCP DoS Attacks on the Parameters of VoIP Streams
## 4 Results and Discussion
### Results for Video Streams Only
#### 4.2.6 Discussion of the Results Obtained for the Video-Stream Study  
The study of the impact of the different TCP DoS attacks on the parameters of the video streams showed the same results as the study of the voice streams. More \"serious\" distortions were observed in the results obtained during the TCP SYN attack because this is the most burdensome DoS attack compared to the others. Due to this attack, there was an increase in the value of the jitter. This increase led to a packet loss of 0.01%. These obtained values were very far from the maximum allowed ones of 1%. The results obtained during the other three attacks were close to the control results.  
The results for the RTD measurement between Asterisk and two subscribers were also within the normal limits. No measurement interruptions of the type \"Destination unreachable\" were observed. The measured values of the RTD were close, almost identical, to the results obtained during the voice-flow study.  
Again, it is noticeable that the \"Responsive Firewall\" was able to neutralize the effect of the individual attacks on the video streams.  
Again, single spikes of large magnitude were observed in the jitter and round-trip-delay graphs during this study. These spikes were due to moments of computational errors.  
Figure 40: RTD between VM_3 and Asterisk for the video-stream study.  
In terms of traffic processed, Asterisk was able to handle this task in both studies. Despite being subjected to DoS attacks, due to which a large amount of traffic is sent to the VoIP server in the form of various TCP packets, voice and video streams, Asterisk was able to process this traffic. Processing this huge amount of traffic had no impact on the system performance. This can be seen very well in the CPU-load statistics for the day of the two tests (Figure 42). It is important to clarify that the VoIP server was only in use at the time of both studies. From the CPU-utilization graph, it can be seen that the CPU was only 0.33-0.34% utilized, which, for a device under DoS attack, is a very good indicator. In the studies by other authors that were discussed in Section 2, similar values were obtained after applying the methods, techniques, and algorithms developed by the authors to detect DoS attacks. The DoS attacks that were applied during the other studies were specific and included modified packet contents.  
Asterisk's memory utilization (Figure 43) during both studies was high, at 69%. It should be noted that this is an average value for the day of the two studies. Therefore, it can be assumed that for the individual studies, the memory load was not very high.  
Figure 43: Memory load of the Asterisk Free PBX during the two studies.  
An idea for the future development of this research is to replicate these attacks, but instead of them being TCP DoS attacks, they will be UDP DoS attacks because the UDP protocol is used to transmit both the voice and video streams, as well as the signaling (SIP) in Asterisk. Additionally, these UDP attacks will also be applied to specific ports or a range of ports.