Computer NetworksDoS and DDoS

DoS and DDoS Attacks

LevelIntermediate

Duration60 mins

TopicDoS and DDoS

3 / 5

Attack Types

A Diverse Arsenal of Attacks

Not all DDoS attacks are created equal. While the goal is always the same—denying service to legitimate users—the methods vary dramatically in sophistication, resource requirements, and the specific vulnerabilities they exploit.

Understanding the taxonomy of attack types is essential for effective defense. A mitigation strategy optimized for volumetric attacks may be completely ineffective against application-layer attacks. Network-layer defenses won't stop HTTP floods. Each attack category demands specific countermeasures, and modern attacks often combine multiple types simultaneously.

This page provides exhaustive coverage of the major attack categories, examining their mechanics at the protocol level and understanding why each remains effective despite decades of security research.

What You Will Learn

By the end of this page, you will possess deep technical understanding of volumetric attacks (UDP floods, ICMP floods, fragmentation attacks), protocol attacks (SYN floods, ACK floods, fragmented packet attacks), and application-layer attacks (HTTP floods, Slowloris, DNS query floods). For each attack type, you'll understand the precise mechanics, why they're effective, and what makes each particularly difficult to defend against.

Attack Classification Framework

Before examining specific attacks, we need a framework for understanding how they differ. The most common classification divides attacks by which layer of the network stack they target and the resource they exhaust.

The Three-Tier Model:

DDoS attacks are typically categorized into three broad categories based on their primary mechanism:

Primary DDoS Attack Categories
Category	Target	Mechanism	Typical Volume	Mitigation Location
Volumetric Attacks	Network bandwidth	Saturate links with traffic	Tbps scale possible	Upstream/scrubbing center
Protocol Attacks	Server/network resources	Exhaust connection states	Millions of packets/sec	Edge devices, firewalls
Application Attacks	Application logic	Consume CPU/memory via valid requests	Thousands of requests/sec	Application layer, WAF

Why Layer Classification Matters:

Each layer requires different instrumentation and countermeasures:

Volumetric attacks must be stopped upstream—if the traffic reaches your network, you've already lost, because your link is saturated. Defense requires traffic to be absorbed elsewhere (CDN, scrubbing center).

Protocol attacks can often be mitigated at the network edge using specialized hardware (firewalls, load balancers) with optimized connection tracking.

Application attacks require application-aware defenses that understand what constitutes legitimate versus malicious requests in context.

The OSI Layer Perspective:

Attack Types by OSI Layer
Layer	Layer Name	Attack Examples	Target Resource
Layer 3	Network	ICMP flood, IP fragmentation	Router CPU, bandwidth
Layer 4	Transport	SYN flood, UDP flood, ACK flood	Connection tables, server CPU
Layer 5	Session	SSL/TLS exhaustion	Crypto processing, memory
Layer 6	Presentation	Malformed SSL requests	SSL termination resources
Layer 7	Application	HTTP flood, DNS flood, Slowloris	Application logic, database

Multi-Vector Reality:

Modern sophisticated attacks rarely use a single vector. A typical advanced DDoS might combine:

Volumetric component to saturate bandwidth and distract operations
Protocol component to exhaust connection tracking resources
Application component to actually bring down the service

Defenders must be prepared for all attack types simultaneously. A defense optimized for one category creates vulnerability to others.

The Bits-per-Second vs. Packets-per-Second Distinction:

Two different metrics matter for DDoS:

Bits per second (bps): Measures bandwidth consumption. Important for volumetric attacks.
Packets per second (pps): Measures packet processing load. Important for protocol attacks.

A single large packet has high bps but low pps. Many small packets have high pps but may have moderate bps. Different attacks optimize for different metrics, targeting different bottlenecks.

The Full-Stack Defense Requirement

Effective DDoS defense requires capabilities at every layer. Network-layer filtering, protocol-aware firewalls, and application-layer analysis must all work in concert. This is why comprehensive DDoS protection is complex and expensive—there's no single solution that addresses all attack types.

Volumetric Attacks: Drowning in Data

Volumetric attacks are the blunt instruments of DDoS. Their goal is simple: send more traffic than the target can handle. When a 10 Gbps network link receives 100 Gbps of traffic, 90% of packets—including legitimate user requests—are dropped.

The Fundamental Principle:

Every network path has finite capacity. Volumetric attacks exploit this by generating traffic volumes that exceed:

The target's Internet connection capacity
The capacity of intermediate network equipment (routers, switches)
The target's upstream provider's willingness to forward attack traffic

UDP Flood Attack:

The UDP flood is the most common volumetric attack due to UDP's stateless nature:

UDP Flood Attack Mechanics
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
UDP Flood Attack Pattern:
================================================
 
Attacker Configuration:
- Source IP: Spoofed (random IPs)
- Destination IP: Target IP
- Destination Port: Random or specific (53, 80, 443, etc.)
- Packet Size: Typically 1400-1480 bytes (near MTU)
- Rate: Maximum possible (millions pps)
 
Attack Packet Structure:
+----------------+----------------+
|  IP Header     |  UDP Header    |
|  (20 bytes)    |  (8 bytes)     |
+----------------+----------------+
|                                 |
|     Random or Pattern Data      |
|     (1000-1400+ bytes)          |
|                                 |
+---------------------------------+
 
Attack Flow:
1. Bot generates UDP packets with spoofed source IPs
2. Packets sent to target at maximum rate
3. Target receives millions of packets per second
4. For each packet, target must:
   - Process IP header
   - Process UDP header  
   - Check if any application listens on that port
   - Generate ICMP "port unreachable" (if no listener)
5. Network link saturates before CPU exhausts
6. Legitimate traffic cannot reach target
 
Why UDP?
- No connection establishment required
- No acknowledgment expected
- Can use spoofed source IPs trivially
- Simple to generate at high rates
- No state to maintain on attacker side

ICMP Flood Attack (Ping Flood):

ICMP floods send massive quantities of ICMP Echo Request (ping) packets:

Mechanics:

Each ping packet requires the target to generate a reply
Processing each packet consumes CPU cycles
Replies consume outbound bandwidth
Link saturation prevents legitimate traffic

Variations:

ICMP Echo Request flood: Classic ping flood
ICMP Destination Unreachable flood: Forces target to process error messages
ICMP Redirect flood: Can disrupt routing tables

Fragmented Packet Flood:

IP fragmentation attacks exploit how systems reassemble fragmented packets:

Fragmentation Attack
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
IP Fragmentation Attack:
================================================
 
Normal Fragmentation:
- Large IP packet split into fragments
- Each fragment has IP header with fragment offset
- Receiver reassembles fragments into original packet
- Receiver must buffer fragments until complete
 
Attack Variations:
 
1. Fragment Flood:
   - Send millions of first fragments (offset=0)
   - Each fragment allocates reassembly buffer
   - Buffer memory exhausted
   - Legitimate fragmented packets cannot be reassembled
 
2. Fragmentation Overlap:
   - Send fragments with overlapping offsets
   - Forces complex reassembly logic
   - Can confuse IDS/firewall inspection
   
3. Incomplete Fragment Sets:
   - Send only first or middle fragments
   - Receiver allocates buffer, waits for completion
   - Buffer never freed (until timeout)
   - Memory exhausted waiting for fragments that never arrive
 
4. Teardrop Attack (Historical):
   - Fragments with impossible offset combinations
   - Caused crashes in unpatched systems
   - Resulted in negative lengths after reassembly
 
Resource Consumption per Fragment Set:
- Memory: 64KB buffer (max IP datagram size) per partial reassembly
- CPU: Fragment matching and reassembly logic
- Timeouts: 30-120 seconds holding resources
- Attack sending 100,000 incomplete sets = ~6.4 GB memory consumed

Characteristics of Volumetric Attacks:

Volumetric Attack Characteristics
Attack Type	Typical Volume	Spoofing	Packet Size	Primary Target
UDP Flood	100 Gbps - 1+ Tbps	Yes (random)	Large (near MTU)	Bandwidth
ICMP Flood	10 Gbps - 100+ Gbps	Yes (random)	Medium (64-1500B)	Bandwidth + CPU
Fragment Flood	10 Gbps - 100+ Gbps	Yes	Various	Memory + CPU
GRE Flood	50 Gbps - 500+ Gbps	Yes	Large	Bandwidth + Protocol processing

The Bandwidth Arms Race

Volumetric attacks create an arms race. If an attacker can generate 1 Tbps and your provider has 10 Gbps of capacity, you lose. This is why organizations must rely on DDoS mitigation services with massive distributed capacity—no single organization can match what a large botnet can generate.

Protocol Attacks: Exploiting Protocol Design

Protocol attacks target the fundamental design of network protocols. Rather than overwhelming bandwidth, they exhaust connection state tables, processing resources, or exploit protocol quirks. These attacks often require less raw bandwidth while achieving devastating effects.

SYN Flood Attack (Deep Dive):

The SYN flood remains one of the most prevalent and effective attacks, exploiting the TCP three-way handshake:

SYN Flood Technical Analysis
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
SYN Flood: Exploiting TCP's Design
================================================
 
TCP Handshake (Normal):
  Client                 Server
     |                      |
     |---SYN-------------->|  Server: Allocate TCB, start timer
     |                      |  TCB size: 280-500 bytes typically
     |<--SYN-ACK-----------|  Server: Wait for ACK (1-2 min default)
     |                      |
     |---ACK-------------->|  Connection established
     |                      |  TCB kept for session duration
 
SYN Flood Attack:
  Attacker                Server
     |                      |
     |-SYN (IP: 1.2.3.4)-->|  TCB #1 allocated
     |-SYN (IP: 2.3.4.5)-->|  TCB #2 allocated
     |-SYN (IP: 3.4.5.6)-->|  TCB #3 allocated
     ...                    ...
     |-SYN (IP: n.n.n.n)-->|  TCB #n allocated
     |                      |
     |<-SYN-ACK to 1.2.3.4-|  SYN-ACK goes to spoofed IP
     |<-SYN-ACK to 2.3.4.5-|  (nowhere / wrong host)
     ...                    |
     |                      |  No ACKs arrive (IPs don't exist)
     |                      |
     |                      |  After timeout (75s-2min):
     |                      |  - Connection times out
     |                      |  - TCB deallocated
     |                      |  But attack sends new SYNs faster
 
Resource Exhaustion Calculation:
- Typical server: 65,535 backlog slots maximum
- TCB memory: ~400 bytes each
- Total memory for backlog: ~26 MB
- SYN packet size: ~60 bytes
- Attack rate: 1 million SYNs/second = ~60 MB/s bandwidth
- Time to fill backlog: <0.07 seconds
 
Once backlog full:
- All new connection attempts (including legitimate) are dropped
- Server appears offline to new users
- Existing connections may continue (if already established)
- Server resources (CPU) consumed sending SYN-ACKs to nowhere

SYN Flood Mitigations (Brief Overview):

Several techniques exist to mitigate SYN floods:

SYN Cookies: Server doesn't allocate state until ACK received; encodes state in initial sequence number
Increased Backlog: More queue space delays exhaustion but doesn't prevent
Reduced Timeout: Faster cleanup of half-open connections
SYN Proxy: Upstream device handles handshake before forwarding to server

ACK Flood Attack:

ACK floods send massive quantities of TCP ACK packets:

ACK Flood Mechanics
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
ACK Flood Attack:
================================================
 
Attack Flow:
1. Attacker sends TCP packets with ACK flag set
2. Source IP typically spoofed
3. Server receives ACKs for nonexistent connections
 
Server Processing for Each ACK:
1. Parse IP header
2. Parse TCP header
3. Lookup connection in connection table
4. Connection not found (spoofed packet)
5. Either:
   - Drop packet (best case)
   - Send RST (reset) packet back (worse - generates traffic)
 
Why ACK Floods Work:
- Packet MUST be processed to determine validity
- Connection table lookup required for each packet
- Even dropping takes CPU cycles
- At millions of packets/second, processing overwhelms CPU
 
Variant: ACK-PSH Flood
- Sets both ACK and PSH flags
- Some systems perform more processing before dropping
- Appears more like legitimate traffic to simple filters
 
Comparison with SYN Flood:
- SYN flood: Exhausts connection table
- ACK flood: Exhausts CPU processing
- SYN flood: Easy to mitigate with SYN cookies
- ACK flood: Requires packet filtering based on state

TCP Connection Exhaustion Attack:

Unlike SYN floods which use half-open connections, this attack completes connections:

Attacker completes full TCP handshake
Connection established successfully
Attacker does nothing (or minimal traffic)
Connection remains open, consuming server resources
Repeat until max connections reached

Why This Works:

Servers have limited concurrent connection capacity
Each connection consumes file descriptors, memory, and server worker threads
Unlike SYN flood, SYN cookies don't help
Attackers don't need to spoof IPs (connection must complete)

RST Flood Attack:

RST (reset) packets normally terminate connections immediately:

Protocol Attack Comparison
Attack	Packet Type	Exhausts	Spoofable	SYN Cookie Effective
SYN Flood	SYN	Connection backlog	Yes	Yes
ACK Flood	ACK	CPU (packet processing)	Yes	No
Connection Exhaustion	Full connection	Max connections, file descriptors	No	No
RST Flood	RST	CPU (connection termination)	Yes	No
FIN Flood	FIN	CPU (closing logic)	Yes	No

PUSH and URG Floods:

The TCP PUSH flag indicates data should be passed immediately to the application. URG indicates urgent data requiring immediate processing. Floods using these flags force increased CPU usage as the system processes each packet's urgency or push request.

Protocol Attack Sophistication:

Advanced protocol attacks combine multiple packet types:

Start with SYN flood to exhaust new connection capacity
Simultaneously ACK flood established connections
Blend in RST packets to disrupt legitimate sessions
Vary packet sizes and flags to defeat simple filtering

The Stateful Defense Challenge

Protocol attacks force defenders into a bind: to filter attack traffic, you often need to track connection state—but tracking state is exactly what the attacks exhaust. Stateful firewalls can become victims themselves when state tables overflow. This is why specialized DDoS scrubbing hardware uses optimized data structures designed for massive state tracking under attack conditions.

Application-Layer Attacks: The Sophistication Premium

Application-layer attacks (Layer 7) represent the most sophisticated attack category. Instead of flooding networks with random data, they send seemingly legitimate requests that consume server resources through normal application processing.

Why Application-Layer Attacks Are Dangerous:

Legitimate-Looking Traffic: Each request may be indistinguishable from a real user
Low Bandwidth Requirement: Hundreds of requests/second instead of millions
Bypass Network Defenses: Volumetric and protocol filters don't help
Target Real Bottlenecks: Exploit actual application weaknesses
Detection Difficulty: No obvious anomaly in packet structure

HTTP Flood Attack:

HTTP floods send large volumes of HTTP requests to web servers:

HTTP Flood Attack Patterns
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
HTTP Flood Attack Types:
================================================
 
Type 1: Simple GET Flood
- Rapid GET requests to homepage or common URLs
- Each request processed by web server
- Database queries, template rendering, etc.
- Easy to detect: identical requests from many IPs
 
Example:
GET / HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
 
Type 2: Randomized GET Flood  
- Requests include random parameters
- Defeats simple caching
- Each request appears unique
 
Example:
GET /products?id=38291&cache_bust=a7f3c9e2 HTTP/1.1
GET /products?id=84712&cache_bust=b8d4f1a3 HTTP/1.1
GET /search?q=random_string_8374 HTTP/1.1
 
Type 3: POST Flood
- POST requests to forms, APIs
- Often to expensive endpoints (login, search, checkout)
- Consumes more server resources than GET
 
Example:
POST /api/search HTTP/1.1
Content-Type: application/json
{"query": "complex search term", "filters": {...}}
 
Type 4: Heavy URL Attack
- Targets URLs known to be resource-intensive
- Report generation, exports, complex queries
- Single request may consume seconds of CPU
 
Example:
GET /reports/generate?start=1900-01-01&end=2099-12-31&format=pdf HTTP/1.1
(This might generate a report spanning 200 years of data)
 
Type 5: Recursive/Nested GET
- Requests that trigger internal cascades
- One request causes many internal requests
- Amplification within the application
 
Sophistication Levels:
- Basic: Same request repeated (detectable by rate limiting)
- Intermediate: Randomized URLs, rotating User-Agents
- Advanced: Full browser emulation, JavaScript execution
- Expert: Mimics real user behavior patterns, timing varies

Slowloris Attack:

Slowloris takes the opposite approach to floods—instead of overwhelming with volume, it holds connections open indefinitely with minimal traffic:

Slowloris Attack Deep Dive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Slowloris: The Low-Bandwidth Application Attack
================================================
 
Attack Principle:
- HTTP servers wait for complete request headers before responding
- Headers must end with blank line (\r\n\r\n)
- Slowloris sends headers very slowly, never sending final blank line
 
Attack Execution:
1. Establish TCP connection to target
2. Send partial HTTP request:
   "GET / HTTP/1.1\r\n"
   "Host: target.com\r\n"
   [No terminating \r\n\r\n]
 
3. Server waits for more headers (request incomplete)
4. Periodically send another header line to reset timeout:
   "X-Custom-Header-1: value\r\n"
   [Still no terminating \r\n\r\n]
 
5. Connection held indefinitely, consuming server worker
 
Connection Maintenance Loop:
  Every 10-20 seconds:
    - Send: "X-Header-N: arbitrary_value\r\n"
    - Server receives data, resets timeout
    - Connection remains "pending"
 
Resource Calculation:
- Apache default: MaxClients = 256
- With Slowloris: 256 connections hold all workers
- Bandwidth per connection: ~50 bytes every 15 seconds
- Total bandwidth: 256 × 50 / 15 = ~850 bytes/second
- Result: ~1 KB/s takes down Apache server
 
Why It Works:
- Thread-per-connection servers allocate worker thread per connection
- Workers wait for complete headers
- All workers busy = no new connections accepted
- Existing users may continue; new users cannot connect
 
Vulnerable Servers:
- Apache (traditional configuration)
- Some versions of IIS
- Any thread-per-connection HTTP server
 
Resistant Servers:
- Nginx (event-based architecture, not thread-per-connection)
- Modern reverse proxies
- Servers with connection timeouts and header size limits

Slow Read Attack:

The reverse of Slowloris—instead of sending slowly, the attacker reads slowly:

Complete a normal HTTP request
Advertise a very small TCP receive window
Read the response extremely slowly (bytes per second)
Server must keep the response in memory waiting for client to receive

Slow POST Attack (RUDY - R U Dead Yet):

Similar to Slowloris but using POST:

Send POST request with Content-Length header indicating large body
Send body one byte at a time, very slowly
Server waits for complete body before processing
Connection held open with minimal bandwidth

DNS Query Flood:

DNS servers are targeted with massive query volumes:

DNS Attack Variations
Attack Type	Query Type	Impact	Mitigation Difficulty
Random Subdomain	A records for random.target.com	Cache miss, recursive lookup	Very High
NXDOMAIN Flood	Nonexistent domains	Cache pollution, resource waste	High
ANY Query Flood	ANY record type (returns all)	Amplified responses	Medium
Recursive Query Flood	Complex chains of queries	Resolver exhaustion	High

Random Subdomain Attack (DNS Water Torture):

This particularly insidious attack targets authoritative DNS servers:

Attacker queries: random123.target.com, random456.target.com, etc.
Recursive resolvers cannot cache (each subdomain is unique)
Every query goes to authoritative nameservers
Authoritative servers overwhelmed
Legitimate DNS queries fail
All services using the domain become unreachable

TLS/SSL Exhaustion Attacks:

SSL/TLS handshakes are cryptographically expensive:

Attack connects via HTTPS
Immediate renegotiation request after handshake
Server performs expensive RSA/ECDSA operations
Repeat at high rate
Server's crypto resources exhausted

Crypto operations like RSA decryption consume orders of magnitude more CPU than normal data processing.

The Application Knowledge Requirement

Defending against application-layer attacks requires deep knowledge of the specific application. There's no generic signature—what looks like an attack on one application might be normal traffic on another. This is why application owners must work closely with security teams to characterize normal behavior and identify exploitable patterns.

Specialized and Emerging Attack Types

Beyond the major categories, several specialized attack types target specific protocols, services, or exploit unique characteristics of modern Internet infrastructure.

QUIC Floods:

QUIC, the successor to TCP for HTTP/3, introduces new attack surfaces:

QUIC runs over UDP, complicating stateful filtering
Initial packets contain cryptographic handshakes
Servers must perform crypto operations before rejecting invalid clients
Attackers can force expensive processing with spoofed initial packets

WebSocket Attacks:

WebSocket connections create persistent application-layer channels:

Establish many WebSocket connections
Send minimal keep-alive traffic
Each connection consumes server resources indefinitely
Unlike HTTP, connections persist without continuous requests
Resource exhaustion through "idle" connections

API-Specific Attacks:

Modern applications expose APIs with complex processing:

API Attack Patterns
Attack Pattern	Target	Example	Defense
GraphQL Depth Attack	Query complexity	Deeply nested queries	Query depth limits
Batch Request Abuse	Parallel processing	Thousands of operations in one request	Batch size limits
File Upload DoS	Storage + processing	Large file uploads consuming resources	Size limits, async processing
Expensive Operation Targeting	Specific endpoints	Report generation endpoints	Rate limiting, queuing
Authentication Exhaustion	Auth system	Login floods, token generation	Throttling, CAPTCHA

GraphQL Depth Attack Example
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Malicious GraphQL Query
# Each nesting level multiplies database queries exponentially
 
query {
  user(id: "1") {
    friends {
      friends {
        friends {
          friends {
            friends {
              friends {
                name
                email
                posts {
                  comments {
                    author {
                      friends {
                        posts {
                          # ... continues nesting
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
 
# With 6 levels of "friends" nesting:
# - User has 100 friends on average
# - 100^6 = 1,000,000,000,000 (1 trillion) potential records
# - Single query could consume minutes of database time
# - A few such queries exhaust all database connections

Algorithmic Complexity Attacks:

These attacks target known worst-case behaviors in algorithms:

Hash Collision Attacks:

Send inputs that all hash to the same bucket
Hash table lookup degrades from O(1) to O(n)
Relatively few carefully crafted requests cause massive slowdowns

Regular Expression DoS (ReDoS):

Submit inputs triggering catastrophic backtracking
Single regex evaluation takes hours
Common in input validation, web application firewalls

Sorting/Search Attacks:

Provide inputs that trigger worst-case sort behavior
O(n log n) becomes O(n²)
Affects any system that sorts user-provided data

IoT Protocol Attacks:

IoT introduces protocols rarely seen in traditional IT:

CoAP (Constrained Application Protocol): UDP-based, amplifiable
MQTT (Message Queuing Telemetry Transport): Publish/subscribe floods
AMQP (Advanced Message Queuing Protocol): Queue exhaustion
Modbus/DNP3: Industrial control protocol attacks

Gaming Protocol Attacks:

Online gaming servers face unique attack patterns:

Source Engine Query Flood: Attacks Valve game servers
Minecraft Server Query Flood: Attacks authentication services
Voice Server Attacks: TeamSpeak, Discord server disruption
Matchmaking Exhaustion: Overwhelm matchmaking services

The Long Tail of Attack Types

This page has covered major attack categories, but the full taxonomy includes hundreds of variations. Each new protocol, each new application framework, each new architectural pattern introduces potential new attack surfaces. Security is an ongoing practice, not a destination.

Multi-Vector Attack Strategies

Sophisticated attackers rarely rely on a single attack type. Multi-vector attacks combine multiple techniques simultaneously, exploiting the fact that defenses optimized for one attack type may leave vulnerabilities against others.

Why Multi-Vector Attacks Are Effective:

Defense Segmentation: Different teams/tools handle different attack types
Resource Division: Defenders must respond on multiple fronts simultaneously
Distraction: Obvious attacks distract from subtle ones
Defense Exhaustion: Switching between attack types exhausts defense coordination
Bypass Potential: If one vector is blocked, others may succeed

Common Multi-Vector Combinations:

Multi-Vector Attack Combinations
Primary Vector	Secondary Vector	Tertiary Vector	Combined Effect
UDP Flood	SYN Flood	HTTP Flood	Bandwidth + state + application exhaustion
DNS Amplification	NTP Amplification	SSDP Amplification	Maximum volumetric damage
SYN Flood	ACK Flood	RST Flood	Protocol-level chaos, connection instability
HTTP GET Flood	Slowloris	HTTP POST Flood	Web server exhaustion from all angles
Volumetric Attack	Application Attack	Reconnaissance	Distract, damage, and probe for weaknesses

Multi-Vector Attack Timeline Example
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
Sophisticated Multi-Vector DDoS Campaign:
================================================
 
Timeline of Real-World Style Attack Pattern:
 
Day -1: Reconnaissance
- Port scans of target infrastructure
- Identify web servers, DNS, API endpoints
- Test response to small probes
- Identify amplification reflectors
 
Day 0, T+0:00 (Attack Start)
- Launch 200 Gbps UDP flood
- Target: Primary IP range
- Purpose: Saturate upstream links, alert SOC
 
T+0:05
- Begin SYN flood (5 million pps)
- Target: Port 443 on all web servers
- Purpose: Exhaust connection tables
 
T+0:10  
- Add DNS amplification (500 Gbps)
- Target: Authoritative DNS servers
- Purpose: Disrupt resolution for all services
 
T+0:15 (SOC Response Begins)
- Defenders enable volumetric mitigation
- Attack partially mitigated
 
T+0:20 (Attacker Adaptation)
- Shift to application-layer attack
- 50,000 HTTP requests/second
- Target: /api/search endpoint
- Purpose: Bypass volumetric filtering
 
T+0:30
- Add Slowloris component
- 10,000 slow connections
- Purpose: Hold web server threads
 
T+0:45 (Defenders Adapting)
- WAF rules deployed for HTTP flood
- Rate limiting engaged
 
T+1:00 (Another Pivot)
- Switch to POST flood against login
- Trigger authentication processing
- Simultaneously restart UDP flood at different IPs
 
T+2:00
- Attack volume decreases
- Probe defenses for remaining gaps
- Document what worked for future attacks
 
T+3:00 - Attack ends
 
Total Attack Surface:
- Network layer: Volumetric + protocol
- Application layer: HTTP + Slowloris  
- Infrastructure: DNS + Web + API
- Result: Defenders fighting on 6+ fronts simultaneously

The Coordination Challenge:

Multi-vector attacks require coordination between different botnet capabilities:

Not all bots can generate all attack types
Different bots may have different bandwidth capacities
Timing synchronization across attack types is crucial
Adaptive attacks require real-time monitoring of target state

Pulse Attacks:

Instead of sustained flooding, pulse attacks send brief intense bursts:

30-second intense attack
2-minute pause
Repeat with different vector
Overwhelms defenses that need time to adapt
Evades rate-limiting based on sustained rates

Carpet Bombing:

Instead of attacking one IP, attack many IPs simultaneously:

Target entire IP range (e.g., /24 subnet = 256 IPs)
Each IP receives small attack volume
Aggregate volume is massive
Per-IP defenses don't trigger
Saturates network links to entire address range

Defense Must Be Comprehensive

Multi-vector attacks mean that defense cannot be optimized for a single attack type. Organizations must maintain capabilities across all layers, with integration between those layers to coordinate response. A firewall that stops SYN floods but ignores HTTP floods provides incomplete protection.

Attack Metrics and Measurement

Understanding how to measure and describe DDoS attacks is essential for communicating about threats, comparing attacks, and sizing defenses appropriately.

Primary Attack Metrics:

DDoS Attack Measurement Metrics
Metric	Unit	What It Measures	Relevance
Bits per Second (bps)	Gbps, Tbps	Data volume over time	Link capacity consumption
Packets per Second (pps)	Mpps	Packet processing load	Router/firewall CPU load
Requests per Second (rps)	K rps	Application-layer volume	Web server/application load
Connections per Second (cps)	K cps	New connection rate	Connection table exhaustion
Concurrent Connections	Number	Simultaneous open connections	State table consumption
Attack Duration	Minutes/hours	How long attack persists	Damage assessment

Understanding the Metrics:

Bits per Second (bps): Measures raw bandwidth consumption. A 1 Tbps attack means 1 trillion bits of data arriving every second. This is the headline number for volumetric attacks.

Modern large attacks: 1-3 Tbps
Major organization's total capacity: 10-100 Gbps typically
DDoS mitigation services: 20-100+ Tbps capacity

Packets per Second (pps): Measures packet processing burden. Network equipment must parse each packet's headers:

Modern routers: Can process 10-100+ Mpps
Attack creating 100 Mpps with 64-byte packets = ~50 Gbps
Small packets maximize pps for given bandwidth
High pps attacks exhaust CPU before bandwidth

The Size vs. Sophistication Tradeoff:

Generally, attack sophistication is inversely correlated with size:

Simple UDP floods can reach Tbps but are easily filtered
Application-layer attacks may be only Kbps but devastating
Most sophisticated attacks balance volume with targeting

Attack Size Comparison
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Attack Size vs. Sophistication Spectrum:
================================================
 
+-------------+------------+-------------------+------------------+
| Attack Type | Typical    | Sophistication    | Detection        |
|             | Volume     | Level             | Difficulty       |
+-------------+------------+-------------------+------------------+
| UDP Flood   | 100 Gbps-  | Low               | Easy             |
|             | 1+ Tbps    | (brute force)     | (obvious volume) |
+-------------+------------+-------------------+------------------+
| SYN Flood   | 10-100     | Medium            | Medium           |
|             | Gbps       | (protocol aware)  | (state tracking) |
+-------------+------------+-------------------+------------------+
| HTTP Flood  | 1-10 Gbps  | Medium-High       | Medium-Hard      |
| (basic)     |            | (app layer)       | (valid requests) |
+-------------+------------+-------------------+------------------+
| HTTP Flood  | 100 Mbps-  | High              | Very Hard        |
| (advanced)  | 1 Gbps     | (browser mimic)   | (looks real)     |
+-------------+------------+-------------------+------------------+
| Slowloris   | 1-10 Mbps  | Medium            | Medium           |
|             |            | (resource exploit)| (conn patterns)  |
+-------------+------------+-------------------+------------------+
| Expensive   | Kbps       | Very High         | Extremely Hard   |
| Query       |            | (app knowledge)   | (legitimate req) |
+-------------+------------+-------------------+------------------+
 
Key Insight:
- Defense sizing based only on Gbps underestimates application attacks
- A 10 Kbps attack can take down a server a 10 Gbps attack can't
- Comprehensive defense must address all sophistication levels

Headlines vs. Reality

Media reports often focus on attack size (Tbps) because large numbers make headlines. However, many devastating attacks use relatively low bandwidth. The 2016 Dyn attack was notable not just for volume but for targeting DNS—critical infrastructure that amplified impact. Don't assume that small-bandwidth attacks are less dangerous.

Summary: The DDoS Attack Taxonomy

This page has provided exhaustive coverage of DDoS attack types. Let's consolidate the essential knowledge:

Key Takeaways

•Three primary categories exist: Volumetric attacks overwhelm bandwidth; protocol attacks exhaust connection resources; application attacks consume CPU through legitimate-looking requests.
•Volumetric attacks are crude but effective — UDP floods, ICMP floods, and fragmentation attacks saturate network links. Defense requires upstream absorption or scrubbing.
•Protocol attacks exploit design, not bugs — SYN floods, ACK floods, and connection exhaustion target inherent protocol characteristics. Mitigations exist but require specialized implementation.
•Application-layer attacks are most sophisticated — HTTP floods, Slowloris, and expensive query attacks require minimal bandwidth but application-specific defenses.
•Specialized attacks target specific technologies — GraphQL depth attacks, ReDoS, hash collisions, and protocol-specific attacks address modern application architectures.
•Multi-vector attacks combine types — Sophisticated attackers use multiple attack types simultaneously, requiring defenders to maintain comprehensive capabilities.
•Metrics matter for communication — Understanding bps, pps, and rps helps communicate about attacks and size appropriate defenses.
•Size doesn't equal impact — A small, sophisticated attack may cause more damage than a large volumetric flood if it targets the right vulnerability.

Looking Ahead:

With a comprehensive understanding of attack types, the next page explores amplification attacks in detail—a special category of attacks that leverage third-party infrastructure to multiply attack power, enabling attackers with limited resources to generate massive traffic volumes.

Page Complete

You now possess deep technical understanding of the full spectrum of DDoS attack types—from volumetric floods through protocol exploitation to sophisticated application-layer attacks. This taxonomy provides the foundation for understanding how defenses must be structured to address each attack category appropriately.

3 / 5

Loading learning content...

Computer NetworksDoS and DDoS

DoS and DDoS Attacks

LevelIntermediate

Duration60 mins

TopicDoS and DDoS

3 / 5

Attack Types

A Diverse Arsenal of Attacks

What You Will Learn

Attack Classification Framework

The Three-Tier Model:

DDoS attacks are typically categorized into three broad categories based on their primary mechanism:

Primary DDoS Attack Categories
Category	Target	Mechanism	Typical Volume	Mitigation Location
Volumetric Attacks	Network bandwidth	Saturate links with traffic	Tbps scale possible	Upstream/scrubbing center
Protocol Attacks	Server/network resources	Exhaust connection states	Millions of packets/sec	Edge devices, firewalls
Application Attacks	Application logic	Consume CPU/memory via valid requests	Thousands of requests/sec	Application layer, WAF

Why Layer Classification Matters:

Each layer requires different instrumentation and countermeasures:

Protocol attacks can often be mitigated at the network edge using specialized hardware (firewalls, load balancers) with optimized connection tracking.

Application attacks require application-aware defenses that understand what constitutes legitimate versus malicious requests in context.

The OSI Layer Perspective:

Attack Types by OSI Layer
Layer	Layer Name	Attack Examples	Target Resource
Layer 3	Network	ICMP flood, IP fragmentation	Router CPU, bandwidth
Layer 4	Transport	SYN flood, UDP flood, ACK flood	Connection tables, server CPU
Layer 5	Session	SSL/TLS exhaustion	Crypto processing, memory
Layer 6	Presentation	Malformed SSL requests	SSL termination resources
Layer 7	Application	HTTP flood, DNS flood, Slowloris	Application logic, database

Multi-Vector Reality:

Modern sophisticated attacks rarely use a single vector. A typical advanced DDoS might combine:

Volumetric component to saturate bandwidth and distract operations
Protocol component to exhaust connection tracking resources
Application component to actually bring down the service

Defenders must be prepared for all attack types simultaneously. A defense optimized for one category creates vulnerability to others.

The Bits-per-Second vs. Packets-per-Second Distinction:

Two different metrics matter for DDoS:

Bits per second (bps): Measures bandwidth consumption. Important for volumetric attacks.
Packets per second (pps): Measures packet processing load. Important for protocol attacks.

A single large packet has high bps but low pps. Many small packets have high pps but may have moderate bps. Different attacks optimize for different metrics, targeting different bottlenecks.

The Full-Stack Defense Requirement

Volumetric Attacks: Drowning in Data

The Fundamental Principle:

Every network path has finite capacity. Volumetric attacks exploit this by generating traffic volumes that exceed:

The target's Internet connection capacity
The capacity of intermediate network equipment (routers, switches)
The target's upstream provider's willingness to forward attack traffic

UDP Flood Attack:

The UDP flood is the most common volumetric attack due to UDP's stateless nature:

UDP Flood Attack Mechanics
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
UDP Flood Attack Pattern:
================================================
 
Attacker Configuration:
- Source IP: Spoofed (random IPs)
- Destination IP: Target IP
- Destination Port: Random or specific (53, 80, 443, etc.)
- Packet Size: Typically 1400-1480 bytes (near MTU)
- Rate: Maximum possible (millions pps)
 
Attack Packet Structure:
+----------------+----------------+
|  IP Header     |  UDP Header    |
|  (20 bytes)    |  (8 bytes)     |
+----------------+----------------+
|                                 |
|     Random or Pattern Data      |
|     (1000-1400+ bytes)          |
|                                 |
+---------------------------------+
 
Attack Flow:
1. Bot generates UDP packets with spoofed source IPs
2. Packets sent to target at maximum rate
3. Target receives millions of packets per second
4. For each packet, target must:
   - Process IP header
   - Process UDP header  
   - Check if any application listens on that port
   - Generate ICMP "port unreachable" (if no listener)
5. Network link saturates before CPU exhausts
6. Legitimate traffic cannot reach target
 
Why UDP?
- No connection establishment required
- No acknowledgment expected
- Can use spoofed source IPs trivially
- Simple to generate at high rates
- No state to maintain on attacker side

ICMP Flood Attack (Ping Flood):

ICMP floods send massive quantities of ICMP Echo Request (ping) packets:

Mechanics:

Each ping packet requires the target to generate a reply
Processing each packet consumes CPU cycles
Replies consume outbound bandwidth
Link saturation prevents legitimate traffic

Variations:

ICMP Echo Request flood: Classic ping flood
ICMP Destination Unreachable flood: Forces target to process error messages
ICMP Redirect flood: Can disrupt routing tables

Fragmented Packet Flood:

IP fragmentation attacks exploit how systems reassemble fragmented packets:

Fragmentation Attack
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
IP Fragmentation Attack:
================================================
 
Normal Fragmentation:
- Large IP packet split into fragments
- Each fragment has IP header with fragment offset
- Receiver reassembles fragments into original packet
- Receiver must buffer fragments until complete
 
Attack Variations:
 
1. Fragment Flood:
   - Send millions of first fragments (offset=0)
   - Each fragment allocates reassembly buffer
   - Buffer memory exhausted
   - Legitimate fragmented packets cannot be reassembled
 
2. Fragmentation Overlap:
   - Send fragments with overlapping offsets
   - Forces complex reassembly logic
   - Can confuse IDS/firewall inspection
   
3. Incomplete Fragment Sets:
   - Send only first or middle fragments
   - Receiver allocates buffer, waits for completion
   - Buffer never freed (until timeout)
   - Memory exhausted waiting for fragments that never arrive
 
4. Teardrop Attack (Historical):
   - Fragments with impossible offset combinations
   - Caused crashes in unpatched systems
   - Resulted in negative lengths after reassembly
 
Resource Consumption per Fragment Set:
- Memory: 64KB buffer (max IP datagram size) per partial reassembly
- CPU: Fragment matching and reassembly logic
- Timeouts: 30-120 seconds holding resources
- Attack sending 100,000 incomplete sets = ~6.4 GB memory consumed

Characteristics of Volumetric Attacks:

Volumetric Attack Characteristics
Attack Type	Typical Volume	Spoofing	Packet Size	Primary Target
UDP Flood	100 Gbps - 1+ Tbps	Yes (random)	Large (near MTU)	Bandwidth
ICMP Flood	10 Gbps - 100+ Gbps	Yes (random)	Medium (64-1500B)	Bandwidth + CPU
Fragment Flood	10 Gbps - 100+ Gbps	Yes	Various	Memory + CPU
GRE Flood	50 Gbps - 500+ Gbps	Yes	Large	Bandwidth + Protocol processing

The Bandwidth Arms Race

Protocol Attacks: Exploiting Protocol Design

SYN Flood Attack (Deep Dive):

The SYN flood remains one of the most prevalent and effective attacks, exploiting the TCP three-way handshake:

SYN Flood Technical Analysis
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
SYN Flood: Exploiting TCP's Design
================================================
 
TCP Handshake (Normal):
  Client                 Server
     |                      |
     |---SYN-------------->|  Server: Allocate TCB, start timer
     |                      |  TCB size: 280-500 bytes typically
     |<--SYN-ACK-----------|  Server: Wait for ACK (1-2 min default)
     |                      |
     |---ACK-------------->|  Connection established
     |                      |  TCB kept for session duration
 
SYN Flood Attack:
  Attacker                Server
     |                      |
     |-SYN (IP: 1.2.3.4)-->|  TCB #1 allocated
     |-SYN (IP: 2.3.4.5)-->|  TCB #2 allocated
     |-SYN (IP: 3.4.5.6)-->|  TCB #3 allocated
     ...                    ...
     |-SYN (IP: n.n.n.n)-->|  TCB #n allocated
     |                      |
     |<-SYN-ACK to 1.2.3.4-|  SYN-ACK goes to spoofed IP
     |<-SYN-ACK to 2.3.4.5-|  (nowhere / wrong host)
     ...                    |
     |                      |  No ACKs arrive (IPs don't exist)
     |                      |
     |                      |  After timeout (75s-2min):
     |                      |  - Connection times out
     |                      |  - TCB deallocated
     |                      |  But attack sends new SYNs faster
 
Resource Exhaustion Calculation:
- Typical server: 65,535 backlog slots maximum
- TCB memory: ~400 bytes each
- Total memory for backlog: ~26 MB
- SYN packet size: ~60 bytes
- Attack rate: 1 million SYNs/second = ~60 MB/s bandwidth
- Time to fill backlog: <0.07 seconds
 
Once backlog full:
- All new connection attempts (including legitimate) are dropped
- Server appears offline to new users
- Existing connections may continue (if already established)
- Server resources (CPU) consumed sending SYN-ACKs to nowhere

SYN Flood Mitigations (Brief Overview):

Several techniques exist to mitigate SYN floods:

SYN Cookies: Server doesn't allocate state until ACK received; encodes state in initial sequence number
Increased Backlog: More queue space delays exhaustion but doesn't prevent
Reduced Timeout: Faster cleanup of half-open connections
SYN Proxy: Upstream device handles handshake before forwarding to server

ACK Flood Attack:

ACK floods send massive quantities of TCP ACK packets:

ACK Flood Mechanics
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
ACK Flood Attack:
================================================
 
Attack Flow:
1. Attacker sends TCP packets with ACK flag set
2. Source IP typically spoofed
3. Server receives ACKs for nonexistent connections
 
Server Processing for Each ACK:
1. Parse IP header
2. Parse TCP header
3. Lookup connection in connection table
4. Connection not found (spoofed packet)
5. Either:
   - Drop packet (best case)
   - Send RST (reset) packet back (worse - generates traffic)
 
Why ACK Floods Work:
- Packet MUST be processed to determine validity
- Connection table lookup required for each packet
- Even dropping takes CPU cycles
- At millions of packets/second, processing overwhelms CPU
 
Variant: ACK-PSH Flood
- Sets both ACK and PSH flags
- Some systems perform more processing before dropping
- Appears more like legitimate traffic to simple filters
 
Comparison with SYN Flood:
- SYN flood: Exhausts connection table
- ACK flood: Exhausts CPU processing
- SYN flood: Easy to mitigate with SYN cookies
- ACK flood: Requires packet filtering based on state

TCP Connection Exhaustion Attack:

Unlike SYN floods which use half-open connections, this attack completes connections:

Attacker completes full TCP handshake
Connection established successfully
Attacker does nothing (or minimal traffic)
Connection remains open, consuming server resources
Repeat until max connections reached

Why This Works:

Servers have limited concurrent connection capacity
Each connection consumes file descriptors, memory, and server worker threads
Unlike SYN flood, SYN cookies don't help
Attackers don't need to spoof IPs (connection must complete)

RST Flood Attack:

RST (reset) packets normally terminate connections immediately:

Protocol Attack Comparison
Attack	Packet Type	Exhausts	Spoofable	SYN Cookie Effective
SYN Flood	SYN	Connection backlog	Yes	Yes
ACK Flood	ACK	CPU (packet processing)	Yes	No
Connection Exhaustion	Full connection	Max connections, file descriptors	No	No
RST Flood	RST	CPU (connection termination)	Yes	No
FIN Flood	FIN	CPU (closing logic)	Yes	No

PUSH and URG Floods:

Protocol Attack Sophistication:

Advanced protocol attacks combine multiple packet types:

Start with SYN flood to exhaust new connection capacity
Simultaneously ACK flood established connections
Blend in RST packets to disrupt legitimate sessions
Vary packet sizes and flags to defeat simple filtering

The Stateful Defense Challenge

Application-Layer Attacks: The Sophistication Premium

Why Application-Layer Attacks Are Dangerous:

Legitimate-Looking Traffic: Each request may be indistinguishable from a real user
Low Bandwidth Requirement: Hundreds of requests/second instead of millions
Bypass Network Defenses: Volumetric and protocol filters don't help
Target Real Bottlenecks: Exploit actual application weaknesses
Detection Difficulty: No obvious anomaly in packet structure

HTTP Flood Attack:

HTTP floods send large volumes of HTTP requests to web servers:

HTTP Flood Attack Patterns
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
HTTP Flood Attack Types:
================================================
 
Type 1: Simple GET Flood
- Rapid GET requests to homepage or common URLs
- Each request processed by web server
- Database queries, template rendering, etc.
- Easy to detect: identical requests from many IPs
 
Example:
GET / HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
 
Type 2: Randomized GET Flood  
- Requests include random parameters
- Defeats simple caching
- Each request appears unique
 
Example:
GET /products?id=38291&cache_bust=a7f3c9e2 HTTP/1.1
GET /products?id=84712&cache_bust=b8d4f1a3 HTTP/1.1
GET /search?q=random_string_8374 HTTP/1.1
 
Type 3: POST Flood
- POST requests to forms, APIs
- Often to expensive endpoints (login, search, checkout)
- Consumes more server resources than GET
 
Example:
POST /api/search HTTP/1.1
Content-Type: application/json
{"query": "complex search term", "filters": {...}}
 
Type 4: Heavy URL Attack
- Targets URLs known to be resource-intensive
- Report generation, exports, complex queries
- Single request may consume seconds of CPU
 
Example:
GET /reports/generate?start=1900-01-01&end=2099-12-31&format=pdf HTTP/1.1
(This might generate a report spanning 200 years of data)
 
Type 5: Recursive/Nested GET
- Requests that trigger internal cascades
- One request causes many internal requests
- Amplification within the application
 
Sophistication Levels:
- Basic: Same request repeated (detectable by rate limiting)
- Intermediate: Randomized URLs, rotating User-Agents
- Advanced: Full browser emulation, JavaScript execution
- Expert: Mimics real user behavior patterns, timing varies

Slowloris Attack:

Slowloris takes the opposite approach to floods—instead of overwhelming with volume, it holds connections open indefinitely with minimal traffic:

Slowloris Attack Deep Dive
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
Slowloris: The Low-Bandwidth Application Attack
================================================
 
Attack Principle:
- HTTP servers wait for complete request headers before responding
- Headers must end with blank line (\r\n\r\n)
- Slowloris sends headers very slowly, never sending final blank line
 
Attack Execution:
1. Establish TCP connection to target
2. Send partial HTTP request:
   "GET / HTTP/1.1\r\n"
   "Host: target.com\r\n"
   [No terminating \r\n\r\n]
 
3. Server waits for more headers (request incomplete)
4. Periodically send another header line to reset timeout:
   "X-Custom-Header-1: value\r\n"
   [Still no terminating \r\n\r\n]
 
5. Connection held indefinitely, consuming server worker
 
Connection Maintenance Loop:
  Every 10-20 seconds:
    - Send: "X-Header-N: arbitrary_value\r\n"
    - Server receives data, resets timeout
    - Connection remains "pending"
 
Resource Calculation:
- Apache default: MaxClients = 256
- With Slowloris: 256 connections hold all workers
- Bandwidth per connection: ~50 bytes every 15 seconds
- Total bandwidth: 256 × 50 / 15 = ~850 bytes/second
- Result: ~1 KB/s takes down Apache server
 
Why It Works:
- Thread-per-connection servers allocate worker thread per connection
- Workers wait for complete headers
- All workers busy = no new connections accepted
- Existing users may continue; new users cannot connect
 
Vulnerable Servers:
- Apache (traditional configuration)
- Some versions of IIS
- Any thread-per-connection HTTP server
 
Resistant Servers:
- Nginx (event-based architecture, not thread-per-connection)
- Modern reverse proxies
- Servers with connection timeouts and header size limits

Slow Read Attack:

The reverse of Slowloris—instead of sending slowly, the attacker reads slowly:

Complete a normal HTTP request
Advertise a very small TCP receive window
Read the response extremely slowly (bytes per second)
Server must keep the response in memory waiting for client to receive

Slow POST Attack (RUDY - R U Dead Yet):

Similar to Slowloris but using POST:

Send POST request with Content-Length header indicating large body
Send body one byte at a time, very slowly
Server waits for complete body before processing
Connection held open with minimal bandwidth

DNS Query Flood:

DNS servers are targeted with massive query volumes:

DNS Attack Variations
Attack Type	Query Type	Impact	Mitigation Difficulty
Random Subdomain	A records for random.target.com	Cache miss, recursive lookup	Very High
NXDOMAIN Flood	Nonexistent domains	Cache pollution, resource waste	High
ANY Query Flood	ANY record type (returns all)	Amplified responses	Medium
Recursive Query Flood	Complex chains of queries	Resolver exhaustion	High

Random Subdomain Attack (DNS Water Torture):

This particularly insidious attack targets authoritative DNS servers:

Attacker queries: random123.target.com, random456.target.com, etc.
Recursive resolvers cannot cache (each subdomain is unique)
Every query goes to authoritative nameservers
Authoritative servers overwhelmed
Legitimate DNS queries fail
All services using the domain become unreachable

TLS/SSL Exhaustion Attacks:

SSL/TLS handshakes are cryptographically expensive:

Attack connects via HTTPS
Immediate renegotiation request after handshake
Server performs expensive RSA/ECDSA operations
Repeat at high rate
Server's crypto resources exhausted

Crypto operations like RSA decryption consume orders of magnitude more CPU than normal data processing.

The Application Knowledge Requirement

Specialized and Emerging Attack Types

Beyond the major categories, several specialized attack types target specific protocols, services, or exploit unique characteristics of modern Internet infrastructure.

QUIC Floods:

QUIC, the successor to TCP for HTTP/3, introduces new attack surfaces:

QUIC runs over UDP, complicating stateful filtering
Initial packets contain cryptographic handshakes
Servers must perform crypto operations before rejecting invalid clients
Attackers can force expensive processing with spoofed initial packets

WebSocket Attacks:

WebSocket connections create persistent application-layer channels:

Establish many WebSocket connections
Send minimal keep-alive traffic
Each connection consumes server resources indefinitely
Unlike HTTP, connections persist without continuous requests
Resource exhaustion through "idle" connections

API-Specific Attacks:

Modern applications expose APIs with complex processing:

API Attack Patterns
Attack Pattern	Target	Example	Defense
GraphQL Depth Attack	Query complexity	Deeply nested queries	Query depth limits
Batch Request Abuse	Parallel processing	Thousands of operations in one request	Batch size limits
File Upload DoS	Storage + processing	Large file uploads consuming resources	Size limits, async processing
Expensive Operation Targeting	Specific endpoints	Report generation endpoints	Rate limiting, queuing
Authentication Exhaustion	Auth system	Login floods, token generation	Throttling, CAPTCHA

GraphQL Depth Attack Example
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
# Malicious GraphQL Query
# Each nesting level multiplies database queries exponentially
 
query {
  user(id: "1") {
    friends {
      friends {
        friends {
          friends {
            friends {
              friends {
                name
                email
                posts {
                  comments {
                    author {
                      friends {
                        posts {
                          # ... continues nesting
                        }
                      }
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
  }
}
 
# With 6 levels of "friends" nesting:
# - User has 100 friends on average
# - 100^6 = 1,000,000,000,000 (1 trillion) potential records
# - Single query could consume minutes of database time
# - A few such queries exhaust all database connections

Algorithmic Complexity Attacks:

These attacks target known worst-case behaviors in algorithms:

Hash Collision Attacks:

Send inputs that all hash to the same bucket
Hash table lookup degrades from O(1) to O(n)
Relatively few carefully crafted requests cause massive slowdowns

Regular Expression DoS (ReDoS):

Submit inputs triggering catastrophic backtracking
Single regex evaluation takes hours
Common in input validation, web application firewalls

Sorting/Search Attacks:

Provide inputs that trigger worst-case sort behavior
O(n log n) becomes O(n²)
Affects any system that sorts user-provided data

IoT Protocol Attacks:

IoT introduces protocols rarely seen in traditional IT:

CoAP (Constrained Application Protocol): UDP-based, amplifiable
MQTT (Message Queuing Telemetry Transport): Publish/subscribe floods
AMQP (Advanced Message Queuing Protocol): Queue exhaustion
Modbus/DNP3: Industrial control protocol attacks

Gaming Protocol Attacks:

Online gaming servers face unique attack patterns:

Source Engine Query Flood: Attacks Valve game servers
Minecraft Server Query Flood: Attacks authentication services
Voice Server Attacks: TeamSpeak, Discord server disruption
Matchmaking Exhaustion: Overwhelm matchmaking services

The Long Tail of Attack Types

Multi-Vector Attack Strategies

Why Multi-Vector Attacks Are Effective:

Defense Segmentation: Different teams/tools handle different attack types
Resource Division: Defenders must respond on multiple fronts simultaneously
Distraction: Obvious attacks distract from subtle ones
Defense Exhaustion: Switching between attack types exhausts defense coordination
Bypass Potential: If one vector is blocked, others may succeed

Common Multi-Vector Combinations:

Multi-Vector Attack Combinations
Primary Vector	Secondary Vector	Tertiary Vector	Combined Effect
UDP Flood	SYN Flood	HTTP Flood	Bandwidth + state + application exhaustion
DNS Amplification	NTP Amplification	SSDP Amplification	Maximum volumetric damage
SYN Flood	ACK Flood	RST Flood	Protocol-level chaos, connection instability
HTTP GET Flood	Slowloris	HTTP POST Flood	Web server exhaustion from all angles
Volumetric Attack	Application Attack	Reconnaissance	Distract, damage, and probe for weaknesses

Multi-Vector Attack Timeline Example
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
Sophisticated Multi-Vector DDoS Campaign:
================================================
 
Timeline of Real-World Style Attack Pattern:
 
Day -1: Reconnaissance
- Port scans of target infrastructure
- Identify web servers, DNS, API endpoints
- Test response to small probes
- Identify amplification reflectors
 
Day 0, T+0:00 (Attack Start)
- Launch 200 Gbps UDP flood
- Target: Primary IP range
- Purpose: Saturate upstream links, alert SOC
 
T+0:05
- Begin SYN flood (5 million pps)
- Target: Port 443 on all web servers
- Purpose: Exhaust connection tables
 
T+0:10  
- Add DNS amplification (500 Gbps)
- Target: Authoritative DNS servers
- Purpose: Disrupt resolution for all services
 
T+0:15 (SOC Response Begins)
- Defenders enable volumetric mitigation
- Attack partially mitigated
 
T+0:20 (Attacker Adaptation)
- Shift to application-layer attack
- 50,000 HTTP requests/second
- Target: /api/search endpoint
- Purpose: Bypass volumetric filtering
 
T+0:30
- Add Slowloris component
- 10,000 slow connections
- Purpose: Hold web server threads
 
T+0:45 (Defenders Adapting)
- WAF rules deployed for HTTP flood
- Rate limiting engaged
 
T+1:00 (Another Pivot)
- Switch to POST flood against login
- Trigger authentication processing
- Simultaneously restart UDP flood at different IPs
 
T+2:00
- Attack volume decreases
- Probe defenses for remaining gaps
- Document what worked for future attacks
 
T+3:00 - Attack ends
 
Total Attack Surface:
- Network layer: Volumetric + protocol
- Application layer: HTTP + Slowloris  
- Infrastructure: DNS + Web + API
- Result: Defenders fighting on 6+ fronts simultaneously

The Coordination Challenge:

Multi-vector attacks require coordination between different botnet capabilities:

Not all bots can generate all attack types
Different bots may have different bandwidth capacities
Timing synchronization across attack types is crucial
Adaptive attacks require real-time monitoring of target state

Pulse Attacks:

Instead of sustained flooding, pulse attacks send brief intense bursts:

30-second intense attack
2-minute pause
Repeat with different vector
Overwhelms defenses that need time to adapt
Evades rate-limiting based on sustained rates

Carpet Bombing:

Instead of attacking one IP, attack many IPs simultaneously:

Target entire IP range (e.g., /24 subnet = 256 IPs)
Each IP receives small attack volume
Aggregate volume is massive
Per-IP defenses don't trigger
Saturates network links to entire address range

Defense Must Be Comprehensive

Attack Metrics and Measurement

Understanding how to measure and describe DDoS attacks is essential for communicating about threats, comparing attacks, and sizing defenses appropriately.

Primary Attack Metrics:

DDoS Attack Measurement Metrics
Metric	Unit	What It Measures	Relevance
Bits per Second (bps)	Gbps, Tbps	Data volume over time	Link capacity consumption
Packets per Second (pps)	Mpps	Packet processing load	Router/firewall CPU load
Requests per Second (rps)	K rps	Application-layer volume	Web server/application load
Connections per Second (cps)	K cps	New connection rate	Connection table exhaustion
Concurrent Connections	Number	Simultaneous open connections	State table consumption
Attack Duration	Minutes/hours	How long attack persists	Damage assessment

Understanding the Metrics:

Bits per Second (bps): Measures raw bandwidth consumption. A 1 Tbps attack means 1 trillion bits of data arriving every second. This is the headline number for volumetric attacks.

Modern large attacks: 1-3 Tbps
Major organization's total capacity: 10-100 Gbps typically
DDoS mitigation services: 20-100+ Tbps capacity

Packets per Second (pps): Measures packet processing burden. Network equipment must parse each packet's headers:

Modern routers: Can process 10-100+ Mpps
Attack creating 100 Mpps with 64-byte packets = ~50 Gbps
Small packets maximize pps for given bandwidth
High pps attacks exhaust CPU before bandwidth

The Size vs. Sophistication Tradeoff:

Generally, attack sophistication is inversely correlated with size:

Simple UDP floods can reach Tbps but are easily filtered
Application-layer attacks may be only Kbps but devastating
Most sophisticated attacks balance volume with targeting

Attack Size Comparison
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Attack Size vs. Sophistication Spectrum:
================================================
 
+-------------+------------+-------------------+------------------+
| Attack Type | Typical    | Sophistication    | Detection        |
|             | Volume     | Level             | Difficulty       |
+-------------+------------+-------------------+------------------+
| UDP Flood   | 100 Gbps-  | Low               | Easy             |
|             | 1+ Tbps    | (brute force)     | (obvious volume) |
+-------------+------------+-------------------+------------------+
| SYN Flood   | 10-100     | Medium            | Medium           |
|             | Gbps       | (protocol aware)  | (state tracking) |
+-------------+------------+-------------------+------------------+
| HTTP Flood  | 1-10 Gbps  | Medium-High       | Medium-Hard      |
| (basic)     |            | (app layer)       | (valid requests) |
+-------------+------------+-------------------+------------------+
| HTTP Flood  | 100 Mbps-  | High              | Very Hard        |
| (advanced)  | 1 Gbps     | (browser mimic)   | (looks real)     |
+-------------+------------+-------------------+------------------+
| Slowloris   | 1-10 Mbps  | Medium            | Medium           |
|             |            | (resource exploit)| (conn patterns)  |
+-------------+------------+-------------------+------------------+
| Expensive   | Kbps       | Very High         | Extremely Hard   |
| Query       |            | (app knowledge)   | (legitimate req) |
+-------------+------------+-------------------+------------------+
 
Key Insight:
- Defense sizing based only on Gbps underestimates application attacks
- A 10 Kbps attack can take down a server a 10 Gbps attack can't
- Comprehensive defense must address all sophistication levels

Headlines vs. Reality

Summary: The DDoS Attack Taxonomy

This page has provided exhaustive coverage of DDoS attack types. Let's consolidate the essential knowledge:

Key Takeaways

•Three primary categories exist: Volumetric attacks overwhelm bandwidth; protocol attacks exhaust connection resources; application attacks consume CPU through legitimate-looking requests.
•Volumetric attacks are crude but effective — UDP floods, ICMP floods, and fragmentation attacks saturate network links. Defense requires upstream absorption or scrubbing.
•Protocol attacks exploit design, not bugs — SYN floods, ACK floods, and connection exhaustion target inherent protocol characteristics. Mitigations exist but require specialized implementation.
•Application-layer attacks are most sophisticated — HTTP floods, Slowloris, and expensive query attacks require minimal bandwidth but application-specific defenses.
•Specialized attacks target specific technologies — GraphQL depth attacks, ReDoS, hash collisions, and protocol-specific attacks address modern application architectures.
•Multi-vector attacks combine types — Sophisticated attackers use multiple attack types simultaneously, requiring defenders to maintain comprehensive capabilities.
•Metrics matter for communication — Understanding bps, pps, and rps helps communicate about attacks and size appropriate defenses.
•Size doesn't equal impact — A small, sophisticated attack may cause more damage than a large volumetric flood if it targets the right vulnerability.

Looking Ahead:

Page Complete

3 / 5