A Distributed Denial of Service (DDoS) attack is an attempt to make an online service or a website unavailable by overloading it with huge floods of traffic generated from multiple sources.

unlike a Denial of Service (DoS) attack, in which one computer and one Internet connection is used to flood a targeted resource with packets, a DDoS attack uses many computers and many Internet connections, often distributed globally in

what is referred to as a botnet.
A large scale volumetric DDoS attack can generate a traffic measured in tens of Gigabits (and even hundreds of Gigabits) per second. We are sure your normal network will not be able to handle such traffic.

whatareBotnets??

Attackers build a network of hacked machines which are known as botnets, by spreading malicious piece of code through emails, websites, and social media. Once these computers are infected, they can be controlled remotely, without their owners' knowledge, and used like an army to launch an attack against any target.
A DDoS flood can be generated in multiple ways. For example:
Botnets can be used for sending more number of connection requests than a server• can handle at a time.
Attackers can have computers send a victim resource huge amounts of random• data to use up the target's bandwidth.
Due to the distributed nature of these machines, they can be used to generate distributed high traffic which may be difficult to handle. It finally results in a complete blockage of a service.

Types of DDoS Attacks

DDoS attacks can be broadly categorized into three categories:

Volume-based Attacks
Protocol Attacks
Application Layer Attacks
Volume-Based Attacks

Volume-based attacks include TCP floods, UDP floods, ICMP floods, and other spoofedpacket floods. These are also called Layer 3 & 4 Attacks. Here, an attacker tries to saturate the bandwidth of the target site. The attack magnitude is measured in Bits per Second (bps).

UDP Flood – A UDP flood is used to flood random ports on a remote host with• numerous UDP packets, more specifically port number 53. Specialized firewalls can be used to filter out or block malicious UDP packets.

ICMP Flood - This is similar to UDP flood and used to flood a remote host with• numerous ICMP Echo Requests. This type of attack can consume both outgoing and incoming bandwidth and a high volume of ping requests will result in overall system slowdown.

HTTP Flood - The attacker sends HTTP GET and POST requests to a targeted web• server in a large volume which cannot be handled by the server and leads to denial of additional connections from legitimate clients.

Amplification Attack - The attacker makes a request that generates a large• response which includes DNS requests for large TXT records and HTTP GET requests for large files like images, PDFs, or any other data files.

Protocol Attacks

Protocol attacks include SYN floods, Ping of Death, fragmented packet attacks, Smurf DDoS, etc. This type of attack consumes actual server resources and other resources like firewalls and load balancers. The attack magnitude is measured in Packets per Second.

DNS Flood – DNS floods are used for attacking both the infrastructure and a DNS• application to overwhelm a target system and consume all its available network bandwidth.

SYN Flood - The attacker sends TCP connection requests faster than the targeted• machine can process them, causing network saturation. Administrators can tweak TCP stacks to mitigate the effect of SYN floods. To reduce the effect of SYN floods, you can reduce the timeout until a stack frees memory allocated to a connection, or selectively dropping incoming connections using a firewall or iptables.

Ping of Death - The attacker sends malformed or oversized packets using a simple• ping command. IP allows sending 65,535 bytes packets but sending a ping packet larger than 65,535 bytes violates the Internet Protocol and could cause memory overflow on the target system and finally crash the system. To avoid Ping of Death attacks and its variants, many sites block ICMP ping messages altogether at their firewalls.

Application Layer Attacks

Application Layer Attacks include Slowloris, Zero-day DDoS attacks, DDoS attacks that target Apache, Windows or OpenBSD vulnerabilities and more. Here the goal is to crash the web server. The attack magnitude is measured in Requests per Second.

Application Attack - This is also called Layer 7 Attack, where the attacker• makes excessive log-in, database-lookup, or search requests to overload the application. It is really difficult to detect Layer 7 attacks because they resemble legitimate website traffic.

Slowloris - The attacker sends huge number of HTTP headers to a targeted web• server, but never completes a request. The targeted server keeps each of these false connections open and eventually overflows the maximum concurrent connection pool, and leads to denial of additional connections from legitimate clients.

NTP Amplification - The attacker exploits publically-accessible Network Time• Protocol (NTP) servers to overwhelm the targeted server with User Datagram Protocol (UDP) traffic.

Zero-day DDoS Attacks - A zero-day vulnerability is a system or application flaw• previously unknown to the vendor, and has not been fixed or patched. These are new type of attacks coming into existence day by day, for example, exploiting vulnerabilities for which no patch has yet been released.