What Is a DDoS Attack and How Does It Work | Cybersecurity | CompTIA
"Typical DoS attacks can include the following:
- Single-source SYN floods: This occurs when an attacker uses a single system to issue a flood attack of SYN packets, manipulating the typical TCP three-way handshake. For example, a SYN flood someone might generate using a Kali Linux computer is not a true DDoS attack because the attack being made is only coming from one device. This is the case even if the attacker uses IP address spoofing. A true DDoS attack is generated by network-level devices, for network-level devices. In other words, you use multiple routers or Memcached servers to attack a network.
- The “ping of death”: Years ago, some network drivers contained flawed code that would crash a system if it received an ICMP packet that contained certain parameters.
- The slow loris attack: The slow loris attack is often called a DDoS attack, but because the attack targets a specific server (in this case, a web server) and usually does not use intermediate networking devices, it is typically a traditional DoS attack.
Each of the above DoS attacks take advantage of software or kernel weaknesses in a particular host. To resolve the issue, you fix the host, and/or filter out the traffic. If you can upgrade a server to mitigate an attack, then it doesn’t qualify as a traditional DDoS attack.
Remember, in a DDoS attack, the threat actor adopts a resource consumption strategy. This strategy involves using what appears to be legitimate requests to overwhelm systems which are, in fact, not legitimate, resulting in system issues.
Attack Strategy: Types of DDoS Attacks
There are three general types of DDoS attacks.
1. Application Layer
Application Layer attacks target the actual software that provides a service, such as Apache Server, the most popular web server on the internet, or any application offered through a CLOUD PROVIDER. This is the most common form of DDoS attack and is often referred to as Layer 7 attacks, after the corresponding number of the application layer in the OSI/RM.
2. Protocol
This occurs when an attack consumes the resources of critical servers and network-based devices, such as a server’s operating system or firewalls. While those resources are overwhelmed, balancers are loaded. Protocol attacks often include manipulating traffic at layers 3 and 4 of the OSI/RM (the network and transport layers, respectively). This is the second most common form of DDoS attack.
3. Volumetric
This occurs when an attack consumes the resources of critical servers and network-based devices, such as a server’s operating system or firewalls. While those resources are overwhelmed, balancers are loaded. Protocol attacks often include manipulating traffic at layers 3 and 4 of the OSI/RM (the network and transport layers, respectively). This is the second most common form of DDoS attack."