generate and send an ICMP time exceeded response. Generating many of these responses can overload the router's CPU. UPnP attack This attack uses an existing vulnerability in Universal Plug and Play (UPnP) protocol to get around a considerable amount of the present defense methods and flood a target's network and servers. The attack is based on a DNS amplification technique, but the attack mechanism is a UPnP router that forwards requests from one outer source to another disregarding UPnP behavior rules. Using the UPnP router returns the data on an unexpected UDP port from a bogus IP address, making it harder to take simple action to shut down the traffic flood. According to the Imperva researchers, the most effective way to stop this attack is for companies to lock down UPnP routers. SSDP reflection attack In 2014 it was discovered that SSDP was being used in DDoS attacks known as an SSDP reflection attack with amplification. Many devices, including some residential routers, have a vulnerability in the UPnP software that allows an attacker to get replies from port number 1900 to a destination address of their choice. With a botnet of thousands of devices, the attackers can generate sufficient packet rates and occupy bandwidth to saturate links, causing the denial of services. The network company Cloudflare has described this attack as the "Stupidly Simple DDoS Protocol". ARP spoofing ARP spoofing is a common DoS attack that involves a vulnerability in the ARP protocol that allows an attacker to associate their MAC address to the IP address of another computer or gateway (like a router), causing traffic intended for the original authentic IP to be re-routed to that of the attacker, causing a denial of service. Defense techniques Defensive responses to denial-of-service attacks typically involve the use of a combination of attack detection, traffic classification and response tools, aiming to block traffic that they identify as illegitimate and allow traffic that they identify as legitimate. A list of prevention and response tools is provided below: Upstream filtering All traffic destined to the victim is diverted to pass through a cleaning center or a scrubbing center via various methods such as: changing the victim IP address in the DNS system, tunneling methods (GRE/VRF, MPLS, SDN), proxies, digital cross connects, or even direct circuits, which separates bad traffic (DDoS and also other common internet attacks) and only sends good legitimate traffic to the