Network DDoS

Network DDoS

Malicious actors commonly use large-scale botnets to conduct ___, and commercial services exist that conduct DDoS attacks and DDoS-like behavior for stress and load testing purposes

Volume-based network DDoS attacks

focus on the sheer amount of traffic causing a denial of service condition:

• UDP floods by sending massive amounts of traffic that the target host will receive and attempt to process. Requires minimal resources

• ICMP floods aka ping floods. Requires more aggregate bandwidth on the side of the attacker than the defender has

Protocol-based network DDoS attacks

focus on the underlying protocols used for networking

Amplified denial-of-service attacks

take advantage of protocols that allow a small query to return large results like a DNS query. Spoofing a system’s IP address as part of a query can result in a DNS server ending much more traffic to the spoofed IP address then was sent to the DNS server originally, amplifying a small amount of traffic into a large response

Reflected denial-of-service attacks

The spoofed IP address causes a legitimate service to conduct the attack, making it harder to know who the attacker is