How DoS Attacks are Conducted

A denial of service (DoS) attack floods a computer system or network with traffic or requests to slow it down or knock it offline. Attackers use several methods, and the damage can range from a sluggish website to a full outage. This post explains how DoS attacks are carried out and what you can do to protect against them.

The methods differ, but they share one goal: overwhelm the target. Common techniques include:

Ping flooding

A ping flood sends a huge number of ICMP echo requests (pings) to a target in an attempt to use up its bandwidth and processing power.

SYN flooding

A SYN flood abuses the TCP handshake. The attacker sends many SYN packets, the first step in opening a connection, but never completes the handshake. The target keeps those half-open connections waiting until it runs out of room for real users.

HTTP flooding

An HTTP flood sends large numbers of web requests to a site, often for pages that are expensive to generate. Because the traffic looks like normal browsing, it is harder to filter.

DNS amplification

A DNS amplification attack uses other people’s DNS servers as a weapon. The attacker sends small DNS queries to open resolvers with the victim’s IP address forged as the source. The resolvers send much larger responses to the victim, multiplying the attacker’s traffic many times over.

Botnets

A botnet is a network of compromised computers and devices that an attacker controls. When the attack comes from many machines at once, it is a distributed denial of service (DDoS) attack, and it is much harder to block because the traffic comes from thousands of sources.

DoS attacks can come from anywhere. That makes the source hard to trace and the attacker hard to stop. They are also hard to defend against because the flood crowds out legitimate traffic. Real users cannot get through, and the system may crash.

Steps to protect against attacks

1. Use a web application firewall (WAF): A WAF filters traffic to web applications and can block malicious requests, including many HTTP floods, before they reach your servers.
2. Implement rate limiting: Rate limiting caps how many requests a single source can make in a set time. It blunts floods from individual sources.
3. Use content delivery networks (CDNs): CDNs spread traffic across many servers around the world. They absorb large attacks that would swamp a single server.
4. Implement network security measures: Firewalls and intrusion detection or prevention systems can spot and block malicious traffic patterns at the network edge.
5. Use a cloud-based DDoS protection service: These services filter traffic in their own large networks before it reaches you. For big volumetric attacks, they are often the only practical defense.

DoS attacks are a real threat to any system that has to stay online. They come in several forms, and the right defenses depend on which ones you are most likely to face. Combining a WAF, rate limiting, a CDN, network controls and a cloud protection service gives you layers of defense.

Plan ahead, too. Keep up with new attack techniques. Write a response plan before you need one: who decides what, which provider to call and how to fail over. Backup systems help keep critical services running if the main ones go down.

Attackers will keep finding new ways to flood a target. The defenses are well understood, though. Put them in place before an attack, not during one, and you will be in a far better position to stay online.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.