An error is reported when parsing the domain name, there are more than two IPs

[xiaoheicheng]

l have some issues when running your code（ on the branch for Windows.）:
1、When I try to use www.cnn.com, it redirects to edition.cnn.com.So I changed the domain name of the attacked server to edition.cnn.com.But an error is reported when parsing the domain name, there are more than two IPs?
2、Should I continue to replace the attacked server or continue to use www.cnn.com or edition.cnn.com as the attacked server?
3. Does the attacker have to use a physical machine? Can I use the bridge mode of the virtual machine?
4. Can the attacker and the victim client be on the same LAN?
Looking forward to your answer

[CvvT]

Hi,

Thanks for your interest.

1、When I try to use www.cnn.com, it redirects to edition.cnn.com.So I changed the domain name of the attacked server to edition.cnn.com.But an error is reported when parsing the domain name, there are more than two IPs?

I don't think redirection could affect the attack. The reason I chose www.cnn.com is that when the user types this URL in Chrome, the initial request is sent via HTTP, and then it is redirected to its HTTPS site. You could monitor the traffic through the Chrome developer tool and verify that. If it is the same case for edition.cnn.com, you could also pick this one, but then you have to adjust some other URLs accordingly (e.g., I selected a few image URLs that belong to the same domain to keep the connection alive).

3. Does the attacker have to use a physical machine? Can I use the bridge mode of the virtual machine?

It is better to use a physical machine.

4. Can the attacker and the victim client be on the same LAN?

Yes. Generally, the closer the attacker is to the victim, the more likely he/she could succeed.

[xiaoheicheng]

Thank you very much for your answer. I also want to ask you a few questions.
1、The client's script initially requests some large pictures from the ipv6 address, and the ip(151.101.79.5) of the server to which the attacker resolves is ipv4, and www.cnn.com is always redirected to the edition. Will these not affect the attack?

2、 What is the cause of timeout? The attack fails due to timeout? I recorded a log. Could you please help analyze the reason for the failure?
record.txt
3、The resource request is only initiated every 80 seconds in the attack script, does that mean that the attacker must deduce the ack number within 80 seconds after deducing the Sequence number?

4、 As mentioned in the discussion section of the paper, we can expand the threat model to consider servers that are wirelessly connected, e.g.,IoT devices.Is the attack on a wirelessly connected IoT device or a wirelessly connected server?