- Types of Volumetric DDoS Attacks
- Types of Volumetric DDoS Attacks
- Signs of Volumetric DDoS Attacks
- Why Are Volumetric Attacks Dangerous?
- Mitigating Volumetric DDoS Attacks
Tom Bienkowski
Director, Product Marketing
What is a Volumetric Attack?
Volumetric attacks employ massive amounts of malicious traffic to overwhelm a server with so much traffic that it eventually exhausts all available bandwidth. These attacks are designed to overwhelm internal network capacity and even centralized DDoS mitigation scrubbing facilities with significantly high volumes of malicious traffic.
These DDoS attacks attempt to consume the bandwidth either within the target network/service, or between the target network/service and the rest of the Internet. There are several specific types of volumetric DDoS attacks.
What Are the Different Types of Volumetric DDoS Attacks?
Volumetric attacks are typically launched against a specific target, usually critical Service Provider (SP) services or enterprise customers. Highly skilled attackers tend to combine volumetric DDoS attacks with application layer attacks to hide the more focused application level attacks which do the real damage.
These types of DDoS attacks take advantage of vulnerable services like memcached, NTP, DNS and SSDP, launching spoofed queries which will flood the destination with large reply packets, filling up links, and many cases, resulting in the target network infrastructure collapsing.
Common volumetric attacks might include:
What Are the Signs of a Volumetric DDoS Attack?
Such DDoS attacks are typically very high bandwidth (up to 100 Gb+ or even going beyond Terabits/second) and are immediately obvious to both the target and upstream connectivity providers. For this reason, determined attackers have learned to actively monitor the results of their attacks, and often randomize attack parameters as soon as defenders can block or limit the current attack vector using DDoS mitigation tools.
To detect volumetric DDoS attacks, flow telemetry analysis (NetFlow, IPFIX, sFlow, etc.) has become the industry standard. Flow telemetry analysis is usually done using dedicated flow analysis tools (often centrally located), which process exported flow telemetry from routers and switches, activating the proper defenses according to the classification of the attack.
Whether You’re a Service Provider or Enterprise, NETCSOUT Can Help
Why Are Volumetric Attacks Dangerous?
While volumetric DDoS attacks are primarily focused on causing congestion, they can also be a sign of an ulterior motive, covering up more sophisticated and surgical DDoS attacks, such as penetration attempts on exposed services. In such cases, attackers may be attempting to cause as much operational disruption and distraction as possible, including monitoring and rapidly mutating their attacks to evade static mitigation techniques.
These kinds of DDoS attacks have been referred to as "Trojan Horse" DDoS and may be intended to disable a firewall or intrusion prevention system, allowing attackers to infiltrate a network, install malware, and ultimately steal data.
How To Mitigate and Prevent Volumetric DDoS Attacks
Mitigating and preventing volumetric attacks requires DDoS protection technologies, such as Remotely-triggered Blackholing (RTBH) and Source-based Remotely-triggered Blackholing (S/RTBH), which have proven to be very effective when used in a situationally appropriate manner.
A BGP feature, FlowSpec (which stands for "flow specification"), has proven to be extremely effective when combined with security-focused flow telemetry analysis tools. Combining flow telemetry analysis with FlowSpec allows for automated detection and analysis of attacks, making it possible to mitigate volumetric attacks at the network edge using the 5-tuple parameters and packet length of the attack, thereby avoiding having to transport volumetric attack traffic to dedicated cleaning centers (usually IDMSes).
The following steps are recommended, particularly in light of network expansion and the adoption of Internet of Things (IoT):
- Use flow telemetry analysis, supplemented with behavioral analysis to detect abnormalities and DDoS attacks. By focusing on understanding what is normal, it becomes easier to identify abnormalities.
- When a volumetric DDoS attack is detected, use FlowSpec to automatically activate network-based mitigation to block the attacks at the edges of the network.
How can NETSCOUT help?
NETSCOUT's Arbor DDoS solution has been protecting the world's largest and most demanding networks from DDoS attacks for more than a decade. We strongly believe that the best way to protect your resources from modern DDoS attacks is through a multi-layer deployment of purpose-built DDoS mitigation solutions.
Only with a tightly integrated, multi-layer defense can you adequately protect your organization from the full spectrum of DDoS attacks.
Arbor SP/Threat Mitigation System
NETSCOUT customers enjoy a considerable competitive advantage by getting both a micro view of their own network, via our products, combined with a macro view of global Internet traffic, via NETSCOUT Cyber Threat Horizon, an interface to our ATLAS threat intelligence and a DDoS Attack Map visualization.
Related Resources
Digital Attack Map
Click here to view a live global map of DDoS attack activity through NETSCOUT Cyber Threat Horizon.
ASERT Blog
Read the latest news and insights from NETSCOUT’s world-class security researchers and analysts.