A DDoS attack is a Distributed Denial of Service attack. This means that the attacker sends many requests simultaneously to one or multiple servers, making it impossible for them to serve legitimate requests promptly. With enough requests sent by the attacker, they are essentially “flooding” the network with traffic, so legitimate users can’t access it.
The use of distributed also implies multiple computers involved in this attack – these are known as bots or clients. When each computer sends a little amount of data, together they send much more.
A TCP packet header with flags set, including SYN (for synchronization), ACK (for acknowledgment), and FIN (to terminate a connection).
How Do DDoS Attacks Work?
There are many types of DDoS attacks, but they all work similarly. The attacker will somehow send requests (ICMP, UDP, etc.) to the servers such that they appear as if they’re coming from the victim’s IP address (the target). This is called spoofing.
Since many fake requests come from one place (the victim’s computer), the server begins to think that it is under attack and denies any service to this person (victimizes them). After some time, legitimate users trying to access the site get frustrated and leave because their connections keep timing out. If you were unable to access a website or online service during peak hours, then chances are there was a DDoS attack on it.
Impacts of DDoS Attackers
- A denial of service (DoS) attack attempts to make a machine or network resource unavailable to its intended users.
- Distributed Denial of Service attacks is when an attacker uses more than one computer to perform such an attack. The computers used in these attacks are usually thousands of miles away from the victim and often protected by proxies, firewalls, and so forth.
- Because these devices require human intervention to handle the traffic load generated by a DoS attack, it is very difficult for Internet Service Providers (ISPs) and hosting companies to block these kinds of attacks in real-time and with complete effectiveness.
- It is like vandalizing in cyberspace: it costs money and resources to websites and affects the web-server of others. Also, these flood attacks lead to loss of network resources and affect the users as well.
Basic Types of DDoS Attacks
Distributed Denial of Service (DDoS) attacks have become common over the last few years. Hacktivists groups, politically motivated individuals, and online criminals work together to launch DDoS attacks on various websites. The target of this type of attack is not any specific web application but rather the availability of a website or an online service.
The types include:
1. Volumetric Attacks
Volumetric DDoS attacks are the most common type of attack on the Internet. An automated tool launched a volumetric attack that floods the victim with massive amounts of traffic. These attacks aim to make it difficult or impossible for legitimate users (e.g., visitors) of the site to access information across all protocol layers.
2. Protocol Attacks
A protocol attack is a type of volumetric attack that uses a specific network communication protocol to saturate the resources on one or more machines. For example, an attacker could send UDP packets to a victim in an attempt to consume all available UDP sockets.
In this case, the application layer (TCP and HTTP) is still functional. However, if the fake requests consume too many UDP sockets, legitimate traffic will be unable to reach its destination.
3. Application-Layer Attacks
An application-layer DDoS attack occurs when a targeted website becomes unavailable because processing capacity at the application layer is exhausted by maliciously generated traffic. Sometimes these attacks use methods such as repeated reloading of a page or continuous submission of incomplete forms.
Also Check: What is an Enumeration Attack?
How to Detect a DDoS Attack?
The easiest way to detect a DDoS attack is by using one or more of the following methods:
1. Monitor Your ISP’s Outbound Traffic
You can monitor your ISP’s outbound traffic. The bandwidth usage will increase significantly if you are under DDoS attacks. If someone is performing a DDoS attack against you, it will show up in your bandwidth usage graphs as an unusual peak, which will go back to normal after the attack has stopped.
2. Intrusion Detection System
You can set up an intrusion detection system (IDS) to automatically monitor your network for suspicious activity that may indicate that a DDoS attack is targeting you. These types of tools use various signatures to detect abnormal traffic patterns to help determine whether something unusual is happening on your network.
3. Traffic Monitoring
You can set up a packet sniffer to monitor all incoming and outgoing traffic on your network. For example, you can install Wireshark to run on the machine. Also, connect a hub to it and install Wireshark on other machines to perform local sniffing of the traffic.
It will help you get an idea of what is actually taking place during the attack. You should try this method when you suspect that there may be ongoing attacks against your server, but none of the monitoring methods detect anything unusual.
4. Use Of Cloudflare
On top of these three methods, if you have connected your website through Cloudflare, they provide DDoS protection, which will automatically filter out any DDoS traffic.
Summing Up
A Distributed Denial-of-Service (DDoS) attack is an attempt to make a machine or network unavailable to users. It is by overwhelming the targeted machine or resource with malicious traffic from multiple sources. This can be caused by either one individual, acting alone, or hundreds of computers working together.
The result is that if you’re attacked by someone who’s determined enough, it may take your business offline, whether for just hours at a time or indefinitely. If this happens when revenue-generating services are active, you will lose money. Worse yet, if customers cannot reach your website during an attack, they might go elsewhere. Hence, efficient protection is essential.
Maryam has been teaching IT as a school teacher for over a decade, and her main subject of choice is Internet safety, especially helping parents keep their families safe and secure online. When Maryam is not teaching or writing she is a big fan of the outdoors, the complete opposite of staring at a computer screen for hours.
