DDoS Protection

On October 21, 2016, a massive Distributed Denial of Service (DDoS) attack brought down major portions of the internet. Twitter, Netflix, Reddit, GitHub, and countless other services became unreachable for millions of users. The culprit? A botnet of compromised IoT devices called Mirai that generated unprecedented traffic volumes—over 1.2 Terabits per second—overwhelming DNS provider Dyn.

This wasn't an isolated incident. DDoS attacks have evolved from a nuisance perpetrated by amateur hackers to a sophisticated weapon capable of crippling critical infrastructure, extorting businesses, and disrupting national services. Understanding DDoS attacks isn't optional for system designers—it's essential for building resilient systems that can withstand the internet's most pervasive threat.

Before diving into specific attack types, we need to establish a clear understanding of what constitutes a DDoS attack and how it differs from other security threats.

Definition:

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal functioning of a targeted server, service, or network by overwhelming it with a flood of internet traffic originating from multiple distributed sources.

The key word is distributed. Unlike a simple Denial of Service (DoS) attack that originates from a single source, DDoS attacks leverage hundreds, thousands, or even millions of compromised systems—collectively called a botnet—to generate attack traffic. This distribution makes DDoS attacks particularly difficult to mitigate because:

1. No single source to block — Traffic comes from diverse IP addresses globally
2. Massive aggregate bandwidth — Even weak individual sources combine to overwhelming volumes
3. Difficult to distinguish — Attack traffic often mimics legitimate user behavior
4. Asymmetric effort — Attackers need minimal resources compared to defenders

The Attacker's Advantage:

DDoS attacks represent a fundamental asymmetry in cybersecurity. Consider:

• A botnet of 100,000 IoT devices, each sending 10 Mbps, generates 1 Tbps of attack traffic
• Building such a botnet costs attackers relatively little—many botnets are available for rent
• DDoS-for-hire services offer attacks for as little as $10-50 per hour
• Meanwhile, defenders must provision infrastructure to absorb or filter this traffic

This asymmetry is why DDoS protection must be architected into systems from the beginning, not bolted on as an afterthought.

To understand DDoS attack types, we must first understand where in the network stack they operate. DDoS attacks are classified according to the OSI (Open Systems Interconnection) model layer they target.

The OSI model divides network communication into seven layers, but for DDoS purposes, we focus on three primary attack categories:

1. Layer 3 (Network Layer) attacks — Target IP and routing infrastructure
2. Layer 4 (Transport Layer) attacks — Target TCP/UDP connection mechanisms
3. Layer 7 (Application Layer) attacks — Target application protocols and business logic

Layers 3 and 4 are often grouped as "infrastructure attacks" or "volumetric attacks" because they primarily attempt to exhaust network bandwidth and connection capacity. Layer 7 attacks are called "application attacks" because they exploit the specific behavior of applications like HTTP, DNS, or other protocols.

Why Layer Classification Matters:

Understanding which layer an attack targets is crucial for mitigation:

• Layer 3/4 attacks can often be mitigated by network-level defenses—upstream filtering, scrubbing centers, and bandwidth capacity
• Layer 7 attacks require application-aware defenses—web application firewalls, rate limiting, and behavioral analysis

Modern sophisticated attacks often combine multiple layers simultaneously, requiring defense in depth strategies that protect at every layer.

Volumetric attacks are the most straightforward DDoS strategy: generate so much traffic that the target's network capacity is exhausted. These are the attacks that make headlines with "X Terabits per second" statistics.

Volumetric attacks target bandwidth—the physical capacity of network links to carry data. If a target has a 10 Gbps connection, sending 15 Gbps of any traffic—legitimate or malicious—will saturate the link and cause legitimate traffic to be dropped.

Common Volumetric Attack Types:

Protocol attacks exploit weaknesses in Layer 3 and Layer 4 protocols themselves. Rather than exhausting bandwidth (though they can do that too), these attacks exhaust the stateful resources that servers maintain to track connections.

Every TCP connection requires the server to allocate memory for tracking connection state. Protocol attacks abuse this requirement to force servers into allocating resources for connections that will never complete legitimately.

The SYN Flood:

The most iconic protocol attack is the SYN Flood, which exploits TCP's three-way handshake:

1. Normal handshake:

   • Client sends SYN
   • Server receives SYN, allocates resources, sends SYN-ACK
   • Client sends ACK
   • Connection established

2. SYN Flood attack:

   • Attacker sends millions of SYN packets with spoofed source IPs
   • Server allocates resources for each, sends SYN-ACK to nowhere
   • ACKs never arrive (spoofed sources don't know to respond)
   • Server's connection table fills with half-open connections
   • Legitimate connections can't be established

Other Protocol Attack Types:

Application layer (Layer 7) attacks are the most sophisticated and dangerous DDoS vectors. Unlike volumetric attacks that require massive bandwidth, L7 attacks can bring down services with relatively modest traffic volumes because they target application logic rather than network capacity.

These attacks are particularly insidious because:

1. Low bandwidth requirements — Thousands of requests can be more damaging than billions of packets
2. Hard to distinguish from legitimate traffic — Attack requests often look like normal user behavior
3. Target expensive operations — Each request may trigger database queries, computations, or external API calls
4. Bypass network-level defenses — Volumetric filters won't detect them

HTTP Flood:

The prototypical L7 attack is the HTTP Flood—legitimate-looking HTTP requests at high volume:

Slowloris Attack:

Slowloris is a brilliant example of asymmetric warfare. Instead of overwhelming with volume, it overwhelms with patience:

1. Open many connections to web server
2. Send partial HTTP requests, but never complete them
3. Periodically send additional headers to keep connections alive
4. Server must hold each connection open waiting for request completion
5. Eventually all connection slots are consumed

A single attacker machine can exhaust thousands of server connections while using minimal bandwidth.

DNS Query Flood:

While DNS amplification is a volumetric attack using DNS, the DNS Query Flood is an L7 attack targeting DNS servers directly. Attackers send massive numbers of unique DNS queries that aren't in cache, forcing recursive resolution. This can overwhelm authoritative DNS servers and knock domains offline even when origin servers are unaffected.

Sophisticated attackers rarely use single attack types. Modern DDoS campaigns employ multi-vector attacks that combine different techniques simultaneously:

Why Multi-Vector?

1. Defense evasion — Defenders tuned to block one attack type may miss others
2. Resource exhaustion across layers — Saturate bandwidth AND exhaust connections AND overwhelm application
3. Distraction — Loud volumetric attacks mask subtle L7 attacks
4. Mitigation whack-a-mole — As one vector is blocked, others continue

Example Multi-Vector Attack Sequence:

Attack-as-a-Service and Booters:

The barrier to launching sophisticated attacks has dropped dramatically. Booter and stresser services provide DDoS-for-hire, allowing anyone with modest funds to rent attack capacity:

• Attacks available from $10-50 per hour
• Multi-vector capabilities included
• Target any IP address or hostname
• No technical expertise required

This democratization of attack capability means every organization is a potential target, not just high-profile companies or governments.

The DDoS landscape continually evolves as attackers discover new protocols to abuse and new techniques to evade defenses. System designers must stay aware of emerging threats:

IoT Botnets:

The explosion of Internet of Things devices has created a massive pool of vulnerable endpoints. Smart cameras, routers, thermostats, and other devices often:

• Ship with default or weak credentials
• Lack automatic security updates
• Have minimal computational resources for security
• Remain online 24/7 with stable connections

Mirai and its successors compromised millions of IoT devices. Future botnets will only grow larger as IoT proliferates.

5G-Amplified Attacks:

As 5G networks deploy, mobile devices gain bandwidth rivaling home broadband. A botnet of compromised smartphones on 5G networks could generate attack traffic at unprecedented scales from truly mobile, global sources.

Understanding why attackers launch DDoS attacks helps organizations assess their risk and prioritize defenses:

1. Extortion and Ransom:

Attackers demand payment to stop or prevent attacks. Ransom DDoS (RDDoS) campaigns often target:

• E-commerce during peak shopping periods
• Gaming during new releases
• Financial services during market hours
• Any business with high cost of downtime

2. Competitive Sabotage:

Unscrupulous competitors may attack rivals:

• During product launches
• When bidding on contracts
• To capture customers during outages

3. Hacktivism:

Ideologically motivated attackers target organizations they oppose:

• Political parties and government sites
• Companies with controversial practices
• During protests and social movements

4. Nation-State Actors:

State-sponsored attacks for political or military objectives:

• Critical infrastructure targeting
• Pre-conflict disruption
• Economic warfare

We've covered the complete taxonomy of DDoS attacks. Before designing defenses, you must understand what you're defending against:

What's Next:

Now that we understand the threat landscape, we'll explore how to defend against it. The next pages cover Layer 3/4 protection mechanisms, Layer 7 protection strategies, WAF implementation, and CDN-based mitigation—building a comprehensive defense-in-depth architecture.