A Distributed Denial of Service (DDoS) attack is a cyberattack that overwhelms a targeted server, service, or network with a flood of internet traffic, rendering it unavailable to legitimate users. DDoS attacks come in various forms, each targeting specific vulnerabilities in a system. Understanding the types of DDoS attacks is crucial for organizations to implement appropriate defenses.

The three main types of DDoS attacks are Volumetric, Protocol, and Application Layer attacks. Each type works differently to overload and disrupt a target, making layered defenses essential for protection.

1. Volumetric DDoS Attacks

Volumetric DDoS attacks are the most common type of DDoS attacks. They aim to saturate the target’s bandwidth by sending a massive volume of traffic, often measured in Gbps (Gigabits per second) or PPS (Packets per second). These attacks consume all available network capacity, preventing legitimate traffic from reaching the target.

How Volumetric Attacks Work:

Volumetric attacks leverage botnets—networks of infected devices that act under a single command—to generate large traffic volumes. This flood of data overwhelms the target’s resources, causing slowdowns or complete outages.

Examples of Volumetric Attacks:

• UDP Floods: Attackers send massive amounts of UDP (User Datagram Protocol) packets to random ports, forcing the server to respond with ICMP packets, overwhelming bandwidth.
• DNS Amplification: Attackers exploit open DNS servers to amplify their attack, sending small requests that generate large responses directed at the target.
• ICMP Floods (Ping Floods): Attackers flood the target with ICMP packets, overwhelming its network infrastructure and bandwidth.

Defense: To mitigate volumetric attacks, organizations use traffic filtering, rate limiting, and cloud-based DDoS protection that absorbs and disperses attack traffic.

2. Protocol DDoS Attacks

Protocol DDoS attacks target vulnerabilities in network protocols to consume server resources or exhaust network capacity. Unlike volumetric attacks that focus on bandwidth, protocol attacks exploit the connection processes that require more resources than the initial request, overwhelming the system.

How Protocol Attacks Work:

Protocol attacks exploit weaknesses in the network stack, such as TCP (Transmission Control Protocol) or SYN (synchronization) handshakes, to deplete server resources. This type of attack can cause servers to remain busy with fake connection requests, rendering them unable to handle legitimate traffic.

Examples of Protocol Attacks:

• SYN Floods: Attackers exploit the TCP handshake process by sending multiple SYN requests without completing the handshake, filling up server connection tables.
• Ping of Death: Attackers send oversized ping packets that the target is unable to handle, causing it to crash.
• Smurf Attack: Attackers send ICMP packets to a network broadcast address, spoofing the target’s IP address. The entire network then responds, flooding the target with ICMP replies.

Defense: Firewall rules, intrusion prevention systems (IPS), and DDoS mitigation solutions can help detect and filter protocol-based attacks.

3. Application Layer DDoS Attacks

Application Layer DDoS attacks target the “top layer” of the OSI model, focusing on the application layer where HTTP requests are processed. These attacks mimic legitimate traffic but at high volumes, overloading the server’s capacity to respond to genuine user requests. Application layer attacks are particularly challenging to detect because they blend in with regular traffic.

How Application Layer Attacks Work:

In an application layer attack, attackers send an overwhelming number of HTTP requests, database queries, or similar requests to a target server. This forces the server to work harder, eventually exhausting its resources. Since these requests appear legitimate, traditional firewalls often have difficulty distinguishing them from genuine user requests.

Examples of Application Layer Attacks:

• HTTP Floods: Attackers send a high volume of HTTP GET or POST requests to overwhelm the server, often targeting resource-intensive pages or functions.
• Slowloris: Attackers open multiple connections to the server and keep them active for as long as possible, keeping the connection open by periodically sending partial requests. This prevents the server from closing connections, eventually exhausting its resources.
• SQL Injection DDoS: Attackers send malicious SQL queries that overload the server’s database, causing response delays or crashes.

Defense: To defend against application layer attacks, use web application firewalls (WAF), rate limiting, and traffic analysis tools to detect and block suspicious patterns.

Summary Table: Types of DDoS Attacks