# Studying the Impact of a UDP DoS Attack on the Parameters of VoIP Voice and Video Streams
## 5 Results
### Results When Only Voice Traffic Is Exchanged
#### 5.1.2 Results When Asterisk Is Attacked  
In this scenario, all subscribers in the network are talking to each other, and while they are talking, Asterisk is attacked/flooded with UDP packets--a UDP DoS attack. Figure 10 represents what traffic is let through by the Asterisk during the attack. As can be seen from the graph, the traffic (RX) received from Asterisk is about 12 MB/s. The transmitted traffic remains the same as it was during normal operation. This figure shows that Asterisk is flooded--a successful UDP DoS attack. Figure 11 shows what traffic is handled by the Asterisk network interface. The presented result confirms the result of the Asterisk network interface monitoring tool. Figure 10: Traffic that proceeded from Asterisk during the attack—voice calls. Figure 9: Jitter variation for the voice stream between VM2 and the Asterisk—normal operation. Figure 12 shows what the utilization of the Asterisk network adapter is during the attack. If the load is above 50%, it means that the network/device is overloaded. As can be seen from the graph, the utilization is around 10%, which is well below the value for an overloaded device. In normal mode, the load is below 1%. Figure 13 represents what the Asterisk CPU load is. As can be seen from the graph, it is a continuation of the results in Section 5.1.1. There is a slight increase in the load for all three measurement time periods, but it is not anything drastic--the load continues to hover around 20%. Figure 14 represents what the Asterisk memory load is. The shown graph is again a continuation of the graph from Figure 6 because the study was conducted on the same day,  
Figure 11: Asterisk’s NIC load during the attack—voice calls. Figure 12: Utilization of the Asterisk’s NIC during the attack—voice calls. Figure 13: Asterisk’s CPU load during the attack—voice calls. shortly after the study in Section 5.1.1 was completed. As can be seen from the graph, there is a slight 1% increase in memory load. The other values are the same as in Figure 6.  
Figure 15 shows the summarized information about the parameters of the voice stream that is exchanged between VM1 (192.168.2.3) and VM2 (192.168.2.6) in both directions--from VM1 to the Asterisk (192.168.2.2), then from Asterisk to the VM2 and vice versa. As can be seen from the results, there is a slight degradation in the parameters--packet loss is 0.02% compared to the same results from Section 5.1.1. The maximum and average jitter values are also slightly inflated. The average jitter value is still much further away from the maximum allowed value of 30 ms. Figure 16 represents how the jitter changes during the entire call in the direction from VM1 to the Asterisk and vice versa. As can be seen from the graph in the direction from VM1 to the Asterisk, an increase in the instantaneous values of the jitter is observed. This increase is minimal and does not affect the quality of the voice stream. These values are still very far from the maximum allowed. Figure 14: Asterisk’s memory load during the attack—voice calls. Figure 15: Parameters of the voice stream between VM_1 and the Asterisk (**a**) and between VM_2 and the Asterisk (**b**) during the attack. Figure 17 represents how the jitter changes during the entire call in the direction from VM2 to the Asterisk and vice versa. As can be seen from the graph, the result is the same as in Figure 16.  
For the other voice stream, between VM3 and VM4, the results are analogous--again, a slight deterioration in the observed parameters, resulting in no deterioration in the quality of the voice stream. Therefore, they are not presented. Figure 18 shows how many UDP packets were sent during the attack. During the attack, 28,986,051 UDP packets with a size of 950 bytes were sent. Even though Asterisk is under a UDP DoS attack, the VoIP server is accessible.