At 2:14 on a Friday afternoon, a retailer's checkout page stops loading. The servers are healthy, nothing has been changed, and no data is missing. The firewall shows a flood of traffic arriving from tens of thousands of addresses in dozens of countries, and every one of them wants the same thing: to use up a resource the store needs to stay open.
That is a distributed denial-of-service attack, and it is one of two attacks in this lesson that work against a network rather than a single host. The other, the protocol downgrade, is quieter: it tries to talk two systems into using weaker security than they support. On the CompTIA Security+ SY0-801 exam both sit under objective 2.5, which expects you to read a scenario's indicators and name the malicious activity behind them. This lesson covers the three families of DDoS attack, how to tell an attack from a busy day, and how downgrade and SSL stripping attacks show up and are stopped.
A DDoS attack exhausts one resource from many sources at once
A denial-of-service (DoS) attack makes a system unavailable to the people who should be able to use it. When the traffic comes from one source, the defense is simple: block that address. A distributed denial-of-service (DDoS) attack uses thousands or millions of sources, so there is no single address to block, and the attack traffic is mixed in with real customers.
Most DDoS traffic comes from a botnet: a large group of compromised devices that an attacker controls through command-and-control (C2) servers. The bots are often home routers, IP cameras and other IoT devices with default passwords and no patching, which is why a botnet can be enormous. The Mirai botnet in 2016 was built almost entirely from such devices and took down the DNS provider Dyn, which made major websites unreachable for hours. Botnets are also rented out, so an attacker with no skill can buy an hour of attack traffic.
Every DDoS attack targets something finite. To classify one, ask which resource is running out:
| Family | Resource exhausted | Measured in | Example |
|---|---|---|---|
| Volumetric | Network bandwidth | Bits per second | UDP flood, DNS or NTP amplification |
| Protocol | Connection state in servers, firewalls, load balancers | Packets per second | SYN flood |
| Application layer | CPU, memory, database or worker threads | Requests per second | HTTP flood on a search page |
DDoS is an attack on availability. Sometimes it is also cover: attackers have used a loud DDoS to keep the security team busy while a quieter intrusion happens elsewhere, so a flood is a reason to look harder at other alerts.
Volumetric attacks fill the pipe, and reflection makes them bigger
A volumetric attack sends more traffic than the victim's internet connection can carry. If the link is 10 Gbps and 40 Gbps arrives, legitimate packets are dropped before they reach any firewall, so nothing the victim runs on its own premises can help. The fix has to happen upstream, at the ISP or a DDoS mitigation provider that can absorb the flood and pass on only clean traffic.
Attackers make volumetric attacks bigger with reflection and amplification. Many UDP services answer a request without any handshake, and UDP doesn't verify the source address. So the attacker's bots send small requests to thousands of open third-party servers with the victim's IP address forged as the source. Each server sends its reply to the victim. That is reflection: the traffic arrives from innocent servers, not from the botnet. Amplification is the bonus when the reply is much larger than the request.
Three services have been abused heavily:
- DNS on UDP 53: open resolvers asked for large records can return responses dozens of times larger than the query.
- NTP on UDP 123: a legacy monitoring command on older NTP servers returned a list of recent clients, an amplification of several hundred times.
- Memcached on UDP 11211: caching servers exposed to the internet amplified by tens of thousands of times, and in 2018 a memcached attack on GitHub peaked at 1.35 Tbps.
Reflection has a distinctive look in a packet capture or flow log. The victim receives a huge volume of responses with no matching requests, all from the same well-known source port:
14:02:11.402 IP 192.0.2.44.123 > 203.0.113.10.48211: NTPv2, Reserved, length 440
14:02:11.402 IP 198.51.100.9.123 > 203.0.113.10.48211: NTPv2, Reserved, length 440
14:02:11.403 IP 192.0.2.201.123 > 203.0.113.10.37702: NTPv2, Reserved, length 440
The company at 203.0.113.10 never asked those servers for the time. On the exam, "traffic from many servers the organization never contacted" or "responses with no requests" points to a reflected attack. The defenses sit on both sides: victims use upstream scrubbing and content delivery networks to spread the load, and everyone else closes the reflectors by not running open resolvers, disabling legacy NTP commands and keeping memcached off the internet. ISPs that drop packets with forged source addresses, known as BCP 38 ingress filtering, take away the spoofing reflection depends on.