DDoS Attack

Why It Matters

Distributed Denial of Service attacks represent one of the most accessible and disruptive forms of cyberattack. By flooding targets with overwhelming traffic, attackers can take websites offline, disrupt business operations, and cause significant financial damage—often without any sophisticated technical skills.

The financial impact of DDoS attacks extends beyond direct revenue loss. Organizations face reputational damage, customer churn, and costs associated with mitigation and recovery. For businesses dependent on online services, even brief outages translate to substantial losses.

DDoS attacks have evolved from simple nuisances to strategic weapons. Nation-states use them to disrupt adversary infrastructure, extortionists demand ransoms to stop ongoing attacks, and competitors may weaponize them for business advantage. The DDoS-for-hire industry makes launching attacks trivially easy and inexpensive.

For security professionals, understanding DDoS attacks is essential for designing resilient architectures and incident response plans. The attacks test not just technical defenses but organizational preparedness and communication during crisis.

How DDoS Attacks Work

DDoS attacks leverage distributed attack sources to generate traffic volumes that overwhelm target capacity:

Attack Infrastructure

• Botnets: Networks of compromised devices (computers, IoT devices, servers) controlled by attackers
• Amplification: Protocols that generate large responses to small requests
• Reflection: Third-party servers unwittingly participate in attacks
• DDoS-for-hire: Criminal services offering attacks for minimal cost

Attack Goals

1. Exhaust bandwidth: Saturate network connections
2. Overwhelm servers: Consume CPU, memory, or connection limits
3. Exploit application logic: Trigger expensive operations
4. Distract defenders: Cover other malicious activity

Types of DDoS Attacks

Volumetric Attacks

Flood the target with massive traffic volumes, measured in bits per second (bps).

Common techniques:

• UDP Flood: Sends large numbers of UDP packets to random ports
• ICMP Flood: Overwhelms with ping requests
• DNS Amplification: Small queries generate large responses reflected at target
• NTP Amplification: Exploits NTP monlist command for 556x amplification

Protocol Amplification Factors:
- DNS:     28-54x
- NTP:     556x
- SSDP:    30x
- Memcached: 51,000x
- CLDAP:   56-70x

Protocol Attacks

Exploit weaknesses in network protocols, measured in packets per second (pps).

Common techniques:

• SYN Flood: Exhausts server resources with half-open connections
• Ping of Death: Malformed ping packets crash systems
• Smurf Attack: ICMP broadcast amplification
• Fragmented Packet Attacks: Exploit reassembly vulnerabilities

Application Layer Attacks

Target specific applications, measured in requests per second (rps). Often hardest to detect as traffic appears legitimate.

Common techniques:

• HTTP Flood: Legitimate-looking requests overwhelm web servers
• Slowloris: Keeps connections open with partial requests
• Low and Slow: Consumes resources with minimal traffic
• DNS Query Flood: Overwhelms DNS infrastructure

# Application layer attack pattern
GET /search?q=expensive-query HTTP/1.1
GET /api/complex-operation HTTP/1.1
POST /login (with invalid credentials, triggering checks)

# Slowloris - partial headers keep connections open
GET / HTTP/1.1
Host: target.com
X-Header: [never completed...]

Detection and Indicators

Traffic Indicators

• Sudden spike in bandwidth or requests
• Traffic from unusual geographic regions
• High volume from single IP ranges
• Abnormal protocol distribution
• Requests targeting specific endpoints

System Indicators

• Increased server response times
• Connection timeouts
• Service unavailability
• Resource exhaustion (CPU, memory, connections)

Mitigation Strategies

Network-Level Protection

• Over-provisioning: Maintain bandwidth capacity exceeding normal needs
• Anycast routing: Distribute traffic across multiple data centers
• Black hole routing: Route attack traffic to null destination (drops legitimate traffic too)
• Rate limiting: Restrict requests per source IP

DDoS Protection Services

• Cloud-based scrubbing: Traffic routed through provider's network for filtering
• Content Delivery Networks (CDNs): Absorb and distribute traffic
• Web Application Firewalls (WAFs): Filter application-layer attacks
• Hybrid solutions: On-premise detection with cloud-based mitigation

Application-Level Defenses

• CAPTCHA challenges: Distinguish humans from bots
• Rate limiting per user/session: Limit request frequency
• Caching: Reduce server processing for repeated requests
• Load balancing: Distribute traffic across multiple servers
• Geographic filtering: Block traffic from irrelevant regions

Incident Response

Immediate Actions:
1. Confirm attack (rule out legitimate traffic)
2. Activate DDoS mitigation service
3. Notify stakeholders and customers
4. Document attack characteristics
5. Coordinate with ISP if needed

During Attack:
- Monitor mitigation effectiveness
- Adjust filtering rules as needed
- Track attack evolution
- Maintain communication

Post-Attack:
- Analyze attack data
- Update defenses
- Review response effectiveness
- Document lessons learned

Career Connection

DDoS defense involves network engineering, security operations, and incident response. Professionals who understand both attack techniques and mitigation strategies are essential for maintaining service availability in hostile environments.