A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is
an attempt to make a computer resource unavailable to its intended users. Although the means to
carry out, motives for, and targets of a DoS attack may vary, it generally consists of the
concerted efforts of a person or persons to prevent an Internet site or service from functioning
efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites
or services hosted on high-profile web servers such as banks, credit card payment gateways, and
even root nameservers.
One common method of attack involves saturating the target (victim) machine with external
communications requests, such that it cannot respond to legitimate traffic, or responds so slowly
as to be rendered effectively unavailable. In general terms, DoS attacks are implemented by
either forcing the targeted computer(s) to reset, or consuming its resources so that it can no
longer provide its intended service or obstructing the communication media between the
intended users and the victim so that they can no longer communicate adequately.
A DoS attack can be perpetrated in a number of ways. The five basic types of attack are:
1. Consumption of computational resources, such as bandwidth, disk space, or processor
time
2. Disruption of configuration information, such as routing information.
3. Disruption of state information, such as unsolicited resetting of TCP sessions.
4. Disruption of physical network components.
5. Obstructing the communication media between the intended users and the victim so that
they can no longer communicate adequately.
A DoS attack may include execution of malware intended to:
Max out the processor's usage, preventing any work from occurring.
Trigger errors in the microcode of the machine.
Trigger errors in the sequencing of instructions, so as to force the computer into an
unstable state or lock-up.
Exploits errors in the operating system to cause resource starvation and/or thrashing, i.e.
to use up all available facilities so no real work can be accomplished.
Crash the operating system itself.
iFrame (D)DoS, in which an HTML document is made to visit a webpage with many
KB's of information many times, until they achieve the amount of visits to where
bandwidth limit is exceeded.
ICMP flood
A smurf attack is one particular variant of a flooding DoS attack on the public Internet. It relies
on misconfigured network devices that allow packets to be sent to all computer hosts on a
particular network via the broadcast address of the network, rather than a specific machine. The
network then serves as a smurf amplifier. In such an attack, the perpetrators will send large
numbers of IP packets with the source address faked to appear to be the address of the victim.
The network's bandwidth is quickly used up, preventing legitimate packets from getting through
to their destination.To combat Denial of Service attacks on the Internet, services like the Smurf
Amplifier Registry have given network service providers the ability to identify misconfigured
networks and to take appropriate action such as filtering.
Ping flood is based on sending the victim an overwhelming number of ping packets, usually
using the "ping" command from unix like hosts (the -t flag on Windows systems has a far less
malignant function). It is very simple to launch, the primary requirement being access to greater
bandwidth than the victim.
SYN flood sends a flood of TCP/SYN packets, often with a forged sender address. Each of these
packets is handled like a connection request, causing the server to spawn a half-open connection,
by sending back a TCP/SYN-ACK packet, and waiting for a packet in response from the sender
address. However, because the sender address is forged, the response never comes. These halfopen
connections saturate the number of available connections the server is able to make,
keeping it from responding to legitimate requests until after the attack ends.
Teardrop attacks
A Teardrop attack involves sending mangled IP fragments with overlapping, over-sized,
payloads to the target machine. This can crash various operating systems due to a bug in their
TCP/IP fragmentation re-assembly code.[4] Windows 3.1x, Windows 95, and Windows NT
operating systems, as well as versions of Linux prior to versions 2.0.32 and 2.1.63 are vulnerable
to this attack.
Peer-to-peer attacks
Attackers have found a way to exploit a number of bugs in peer-to-peer servers to initiate DDoS
attacks. The most aggressive of these peer-to-peer-DDoS attacks exploits DC++. Peer-to-peer
attacks are different from regular botnet-based attacks. With peer-to-peer there is no botnet and
the attacker does not have to communicate with the clients it subverts. Instead, the attacker acts
as a 'puppet master,' instructing clients of large peer-to-peer file sharing hubs to disconnect from
their peer-to-peer network and to connect to the victim’s website instead. As a result, several
thousand computers may aggressively try to connect to a target website. While a typical web
server can handle a few hundred connections/sec before performance begins to degrade, most
web servers fail almost instantly under five or six thousand connections/sec. With a moderately
big peer-to-peer attack a site could potentially be hit with up to 750,000 connections in a short
order. The targeted web server will be plugged up by the incoming connections. While peer-topeer
attacks are easy to identify with signatures, the large number of IP addresses that need to be
blocked (often over 250,000 during the course of a big attack) means that this type of attack can
overwhelm mitigation defenses. Even if a mitigation device can keep blocking IP addresses,
there are other problems to consider. For instance, there is a brief moment where the connection
is opened on the server side before the signature itself comes through. Only once the connection
is opened to the server can the identifying signature be sent and detected, and the connection torn
down. Even tearing down connections takes server resources and can harm the server.
