DDoS: SYN Floods, Amplification, and Slowloris
A networked service has finite resources: link capacity, packet-processing time, connection state, file descriptors, worker slots, memory, CPU, and downstream capacity. A denial-of-service attack consumes one or more of those resources so legitimate users cannot make progress.
A denial-of-service (DoS) attack can come from one source. A distributed denial-of-service (DDoS) attack coordinates traffic from many sources, such as compromised devices or abused third-party servers. Distribution makes filtering harder and can produce far more traffic than one sender.
Not every overload is malicious. A product launch, failed retry policy, crawler bug, or network misconfiguration can create similar symptoms. A robust system must handle overload safely even before the operator knows its cause.
This chapter focuses on three attacks with very different traffic shapes:
- A SYN flood exhausts TCP connection-establishment state or packet-processing capacity.
- A reflection and amplification attack uses spoofed UDP requests to make third-party servers send larger responses to the victim.
- Slowloris holds many HTTP connections open by making incomplete progress, exhausting application-facing connection resources with little bandwidth.
The correct defense depends on which resource is becoming unavailable.