What is a DDoS Attack?

A TCP SYN flood attack renders a web server unable to handle new connection requests. It drives all of the target server’s communications ports into a half-open state. It achieves this result by preventing the completion of the TCP three-way handshake between client and server on every port. The handshake must be completed before a communications port between the client and server can be fully open and available.

The SSL (Secure Socket Layer) and TLS (Transport Layer Security) encryption protocols underlie secure services on the internet. Because these protocols are resource intensive, the services that rely on them are particularly vulnerable to resource exhaustion attacks. During these attacks, clients send small requests that force the server to perform a disproportionately large amount of work to set up a secure session.

In a DNS Flood, attackers use DNS as a variant of a UDP flood. Attackers send valid but spoofed DNS request packets at a very high packet rate and from a very large group of source IP addresses. Since these appear as valid requests, the victim's DNS servers proceeds to respond to all requests. The DNS server can be overwhelmed by the vast number of requests. This attack consumes large amounts of network resources that exhaust the DNS infrastructure until it goes offline, taking the victim's Internet access (www) down with it.

BGP hijacking (sometimes referred to as prefix hijacking, route hijacking or IP hijacking) is the illegitimate takeover of groups of IP addresses by corrupting Internet routing tables maintained using the Border Gateway Protocol (BGP).

The Slowloris attack exhausts connection resources by sending small chunks of HTTP request headers to the target web server too slowly. By design, the web server must wait for all the header chunks to arrive or time out the HTTP request. The attack client sends each small HTTP header chunk just before the server’s HTTP request time out expires.

When many malicious hosts launch simultaneous Slowloris attacks from a botnet, all the available connections to a target server are opened at once. As a result, the server is unable to handle legitimate HTTP requests.

In a Slow Post DDoS Attack, attackers send valid TCP-SYN packets and perform TCP three-way handshakes with the victim to establish valid sessions between the attacker and victim. The attacker first establishes a large number of valid sessions and then sends HTTP POST commands, specifying the number of bytes in the HTTP message body which will be sent to the server. The attacking machines will then start sending the contents of the message body at very slow rate, often 1 byte at a time, consuming excess resources on the receiving server as each session will be blocked until all the contents of the message body has been delivered. Slow Post Attacks are always non-spoofed in order to hold sessions open for long periods of time.

In a Slow Read DDoS Attack, attackers send valid TCP-SYN packets and perform TCP three-way handshakes with the victim to establish valid sessions between the attacker and victim. The attacker first establishes a large number of valid sessions and begins to request to download a document or large object from each attacking machine. Once the download begins the attacking machines begin to slow down the acknowledgement of received packets. The attackers will continue to slow down the receipt of packets, which consumes excess resources on the delivering server since all the associated processes appear to be in a very slow receiving network. Slow Read Attacks are always non-spoofed in order to hold sessions open for long periods of time.

High HTTP/S requests per second are imposed on a server by the attackers to make the server busy.

A low and slow attack, also known as a slow-rate attack, involves what appears to be legitimate traffic at a very slow rate. This type of state exhaustion attack targets application and server resources and is difficult to distinguish from normal traffic.

Attackers uploads large size file or data to hold the connection of the server in order to exhaust TCP or server resources on the server.

Botnets have become major engines for malicious activities in cyberspace nowadays. To sustain their botnets and disguise their malicious actions, botnet owners are mimicking legitimate cyber behavior to fly under the radar.

A reflection amplification attack is a technique that allows attackers to both magnify the amount of malicious traffic they can generate and obscure the sources of the attack traffic. 

 A DNS reflection/amplification distributed denial-of-service (DDoS ) attack is a common two-step DDoS attack in which the attacker manipulates open DNS servers.