Understanding Distributed Denial of Service Attacks
Distributed Denial of Service (DDoS) attacks overwhelm target systems with malicious traffic, rendering services unavailable to legitimate users. Unlike simple DoS attacks from a single source, DDoS attacks leverage botnets—networks of thousands or millions of compromised devices—making them vastly more powerful and harder to mitigate through simple IP blocking.
Three Categories of DDoS Attacks
- Volumetric Attacks: These flood the target network with traffic to consume all available bandwidth. UDP floods send massive streams of UDP packets to random ports, forcing the target to process and respond with ICMP unreachable messages. DNS amplification attacks exploit open DNS resolvers—a small 60-byte query can generate a 4,000-byte response (67x amplification), directed at the victim through IP spoofing. The largest recorded DDoS attack reached 2.3 Tbps, targeting Google in 2017, but attacks exceeding 1 Tbps are now common.
- Protocol Attacks: These exploit weaknesses in network protocols. SYN floods consume connection state tables by sending TCP SYN packets without completing the three-way handshake. Smurf attacks broadcast ICMP echo requests with the victim IP as the source. Ping of Death sends oversized or fragmented ICMP packets. These attacks are measured in packets per second (PPS) rather than bits per second.
- Application Layer Attacks: These target specific applications rather than network infrastructure. HTTP floods overwhelm web servers with legitimate-looking GET or POST requests. Slowloris opens many connections and sends partial HTTP headers, keeping connections open indefinitely until server resources are exhausted. These are harder to detect because they appear as legitimate traffic.
Mitigation Strategies
- Cloud-Based Scrubbing Centers: Services like Cloudflare, Akamai, and AWS Shield Advanced route all traffic through globally distributed scrubbing centers that filter malicious traffic before it reaches your network. Cloudflare network spans 330+ cities and can absorb attacks exceeding 100 Tbps.
- BGP Blackholing (RTBH): Remotely Triggered Black Hole routing drops all traffic destined to the target at the ISP edge, protecting the ISP network but also making the target completely unreachable. This is a blunt instrument used as a last resort.
- Rate Limiting: Configure routers and firewalls to limit connection rates, concurrent connections, and traffic per-source-IP. While effective against simple floods, sophisticated application-layer attacks can stay below rate thresholds.
- Anycast Network Distribution: Deploying services across multiple geographically distributed data centers using anycast IP addressing distributes attack traffic, making it harder to overwhelm any single location.
In Canada, the Communications Security Establishment (CSE) publishes the Top 10 IT Security Actions, which include DDoS mitigation strategies. Canadian organizations should also consider the Canadian Cyber Incident Response Centre (CCIRC) for incident coordination.
