Denial of service and DDoS: volumetric, protocol, and application floods
The three families of denial-of-service attack, what each exhausts (bandwidth, connection state, or application work), how botnets and reflection amplify them, and the layered defenses from upstream scrubbing to rate limits.
Diagram
What each flood exhausts
Bandwidth, often through reflection off open DNS, NTP, or memcached servers.
ingress Gbps on edge link: 0.8 -> 41.6 (link capacity 10) top source port: UDP 123 (NTP monlist responses)
The example on the open step is one illustration, or the fix you can paste into an application you own.
What this page is made of
A short map of the pieces. Each piece says what fails, who is affected, what you would notice, and what you change.
Reflection and amplification
- What fails
- Small spoofed requests to open UDP services produce large replies to the victim.
- Who is affected
- Victims, and owners of the open reflectors.
- What you would notice
- Your servers answering DNS, NTP, or SSDP from the internet.
- What you change
- Close open resolvers and services, and disable monlist-style commands.
Botnets
- What fails
- Compromised devices send the traffic, so blocking sources one by one fails.
- Who is affected
- Victims and device owners.
- What you would notice
- Thousands of sources, many consumer ISPs.
- What you change
- Rely on upstream protection that filters at scale.
Application floods
- What fails
- Each request is valid but costly.
- Who is affected
- Users of the service.
- What you would notice
- Spikes on uncached or search endpoints.
- What you change
- Cache, rate-limit per client, and add challenges for suspicious traffic.
Telling attack from popularity
A flash crowd and an attack can both spike traffic. Attacks usually show unusual source distributions, repeated identical requests, odd user agents, and traffic to one expensive path. Keep baselines of requests per second, unique clients, and error rates.
A minimal runbook
Decide before the incident who can switch on extra protection and which features can be degraded.
- Provider contact and account details
- Thresholds that trigger escalation
- Features to disable first (search, exports)
- How to tell customers
Tool pages
The LOIC and hping3 pages explain how those tools generate traffic and what defenders see, using lab setups only.
Check yourself
Recognition and the fix. Nothing here is a procedure.
An edge link is saturated by UDP 123 responses. What kind of attack is it?
Go deeper
Specific techniques, exercises, and glossary cards for this topic.