What is DDoS(Distributed Denial of Service) attack

DDoS(Distributed Denial of Service) attack is an attempt to make an online service or a website unavailable by overloading it with huge floods of traffic generated from multiple sources.

Unlike a Denial of Service (DoS) attack, in which one computer and one Internet connection are used to flood a targeted resource with packets.

The DDoS attack uses many computers and many Internet connections, often distributed globally in what is referred to as a botnet.  

A large-scale volumetric DDoS attack can generate traffic measured in tens of Gigabits (and even hundreds of Gigabits) per second. We are sure your normal network will not be able to handle such traffic.

Types of DDoS(Distributed Denial of Service) Attacks

1. Volume-Based DDoS Attacks

Volume-based DDoS(Distributed Denial of Service) attacks include TCP floods, UDP floods, ICMP floods, and other spoofed packet floods.

These are also called Layer 3 & 4 Attacks. Here, an attacker tries to saturate the bandwidth of the target site.

The Volume-based DDoS(Distributed Denial of Service) attack magnitude is measured in Bits per Second (bps).

• UDP Flood − A UDP flood is used to flood random ports on a remote host with numerous UDP packets, more specifically port number 53. Specialized firewalls can be used to filter out or block malicious UDP packets.
• ICMP Flood, − This is similar to the UDP flood and is used to flood a remote host with numerous ICMP Echo Requests. This type of attack can consume both outgoing and incoming bandwidth and a high volume of ping requests will result in an overall system slowdown.
• HTTP Flood − The attacker sends HTTP GET and POST requests to a targeted web server in a large volume which cannot be handled by the server and leads to denial of additional connections from legitimate clients.
• Amplification Attack − The attacker makes a request that generates a large response which includes DNS requests for large TXT records and HTTP GET requests for large files like images, PDFs, or any other data files.

2. Protocol Attacks

Protocol DDoS attacks include SYN floods, Ping of Death, fragmented packet attacks, Smurf DDoS, etc.

This type of DDoS(Distributed Denial of Service) attack consumes actual server resources and other resources like firewalls and load balancers.

The DDoS(Distributed Denial of Service) attack magnitude is measured in Packets per Second.

• DNS Flood − DNS floods are used for attacking both the infrastructure and a DNS application to overwhelm a target system and consume all its available network bandwidth.
• SYN Flood − The attacker sends TCP connection requests faster than the targeted machine can process them, causing network saturation. Administrators can tweak TCP stacks to mitigate the effect of SYN floods. To reduce the effect of SYN floods, you can reduce the timeout until a stack frees memory allocated to a connection, or selectively drop incoming connections using a firewall or IP tables.
• Ping of Death − The attacker sends malformed or oversized packets using the simple ping command. IP allows sending 65,535 bytes packets but sending a ping packet larger than 65,535 bytes violates the Internet Protocol and could cause memory overflow on the target system and finally crash the system. To avoid Ping of Death attacks and their variants, many sites block ICMP ping messages altogether at their firewalls.

3. Application Layer Attacks

Application Layer Attacks include Slowloris, Zero-day DDoS(Distributed Denial of Service) attacks, DDoS attacks that target Apache, Windows, or OpenBSD vulnerabilities, and more.

Here the goal is to crash the web server. The attack magnitude is measured in Requests per Second.

• Application Attack − This is also called Layer 7 DDoS Attack, where the attacker makes excessive log-in, database-lookup, or search requests to overload the application. It is really difficult to detect Layer 7 attacks because they resemble legitimate website traffic.
• Slowloris − The attacker sends a huge number of HTTP headers to a targeted web server, but never completes a request. The targeted server keeps each of these false connections open and eventually overflows the maximum concurrent connection pool, which leads to the denial of additional connections from legitimate clients.
• NTP Amplification − The attacker exploits publically-accessible Network Time Protocol (NTP) servers to overwhelm the targeted server with User Datagram Protocol (UDP) traffic.
• Zero-day DDoS Attacks − A zero-day vulnerability is a system or application flaw previously unknown to the vendor and has not been fixed or patched. These are a new type of attack coming into existence day by day, for example, exploiting vulnerabilities for which no patch has yet been released.

WHAT ARE THE CONSEQUENCES OF A SUCCESSFUL DDoS ATTACK?

When a public-facing website or application is unavailable, that can lead to angry customers, lost revenue, and brand damage.

When business-critical applications become unavailable, operations and productivity grind to a halt.

Internal websites that partners rely on means supply chain and production disruption. A successful DDoS(Distributed Denial of Service) campaign also means that your organization has invited more attacks.

You can expect attacks to continue until more robust DDoS defenses are deployed.  

DDoS Attack Taxonomy: Layer 4 Transport vs Layer 7 Application Defense

Modern distributed denial-of-service threats span two fundamentally distinct architectural methodologies: volumetric network floods that exhaust transport pipelines, and sophisticated application floods that overwhelm web application workers. The matrix below contrasts both threat surfaces:

Modern DDoS Mitigation Blueprint: Kernel eBPF & Anycast Edge

• Global Anycast Scrubbing Architecture: By announcing the same IP address from hundreds of data centers worldwide via BGP Anycast, distributed volumetric floods are automatically splintered into manageable regional fragments, absorbed locally at the edge without reaching origin servers.
• Linux Kernel eBPF / XDP Line-Rate Filtering: When volumetric SYN or UDP packets penetrate the edge, modern Linux defenses employ eBPF programs attached to the Express Data Path (XDP). Operating directly inside the network interface card (NIC) driver, XDP evaluates packet headers and issues XDP_DROP instructions at 40+ million packets per second without allocating a single kernel sk_buff socket structure.
• Defeating Low-and-Slow Application Attacks (Slowloris): Slowloris holds web server connections open by transmitting partial HTTP request headers at prolonged 15-second intervals. Origin web servers neutralize Slowloris by enforcing aggressive timeout thresholds (e.g., Nginx client_header_timeout 5s; and client_body_timeout 5s;).