Denial-of-Service Attacks

A DoS (Denial-of-Service) attack tries to make a service unavailable to legitimate users by overwhelming it. Unlike attacks that steal data, a DoS targets availability, the third pillar of the CIA triad.

By flooding a server or network with more traffic or requests than it can handle, the attacker exhausts its resources until real users cannot get through.

A plain DoS comes from a single source. A DDoS (Distributed Denial-of-Service) comes from many sources at once, often thousands, making it far harder to stop.

Blocking one attacking IP is easy; blocking traffic from tens of thousands of scattered addresses, many of them innocent hijacked machines, is the real challenge that makes DDoS so dangerous.

DDoS attacks are usually powered by a botnet: a network of malware-infected computers and IoT devices the attacker controls remotely. Each infected machine, a bot or zombie, sends attack traffic on command.

The owners often have no idea their devices are participating. Insecure IoT gadgets like cameras have built enormous botnets capable of massive attack volumes.

Volumetric attacks simply flood the target with enormous traffic to saturate its internet bandwidth. If the pipe is full of junk, legitimate traffic cannot get through.

Examples include UDP floods and ICMP (ping) floods. The defense is having enough capacity or upstream scrubbing to absorb or filter the flood before it fills your link.

Protocol attacks exhaust server or device resources by abusing how protocols work. A classic example is the SYN flood: the attacker starts many TCP connections (sending SYN packets) but never completes them, filling the server connection table.

The server waits for handshakes that never finish until it can accept no new connections, denying service to real users.

Application-layer attacks target the software itself with seemingly legitimate requests that are expensive to process, like complex searches or repeated page loads. They use far less bandwidth, so they are stealthier.

Because each request looks normal, distinguishing attack traffic from real users is hard, making these attacks particularly tricky to detect and filter without harming legitimate visitors.

Amplification attacks multiply the attacker firepower. The attacker sends small requests with a spoofed source address (the victim) to servers that reply with much larger responses, like misconfigured DNS or NTP servers.

A tiny request triggers a huge reply aimed at the victim, so the attacker amplifies their traffic many times over while hiding behind spoofing.

Signs of a DoS include sudden traffic spikes, services slowing or timing out, unusually high resource use, and a flood of connections from many addresses. Monitoring and baselines help spot the abnormal surge quickly.

Fast detection matters: the sooner you recognize an attack versus a normal traffic spike, the sooner mitigation can begin and downtime can be limited.

Defenses layer up:

• Rate limiting caps requests per source.
• Firewalls and IPS filter known attack patterns.
• Cloud DDoS scrubbing services absorb huge floods upstream.
• CDNs (Content Delivery Networks) spread load across many servers.

Anti-spoofing filtering on the internet also reduces amplification attacks at their source.

DoS is uniquely difficult because attack traffic can look like legitimate traffic and arrive from countless sources. You cannot simply block everything, or you deny service yourself.

The most resilient defense combines ample capacity, upstream scrubbing, good filtering, and an incident plan, accepting that absolute prevention is impossible and resilience is the realistic goal.

A DoS attacks availability by overwhelming a target; a DDoS does so from many sources via a botnet. Types include volumetric, protocol (like SYN floods), application-layer, and amplification attacks. Defenses combine rate limiting, firewalls, CDNs, and cloud scrubbing, plus anti-spoofing to curb amplification.

Test your DoS knowledge.

A DoS overwhelms a service to deny availability; a DDoS uses many sources from a botnet. Attack types include volumetric floods, protocol attacks like SYN floods, stealthy application-layer attacks, and amplification via spoofing. Defenses layer rate limiting, firewalls, CDNs, and cloud DDoS scrubbing.