What is DDoS? How to Protect your network from it?

DDoS stands for Distributed Denial of the Server, as its name indicates it.

This is a service mitigation attack that uses multiple servers or machines operating from different locations to attack a single server or web application. Target is bombarded with a load of traffic to stop its services; these attacks are mostly made for ransom from the attacker so that owner of the website could pay for his services to be run properly. These attacks can last for days, starting from hours. The longest DDOS attack recorded was Q2 209, which lasted 509 hours or simply more than 21 days.

Common DDOS attack Types

UDP Flood

A user datagram protocol is used in DDoS attacks with the help of which a number of UDP packets were sent to the victim host on random ports so that the host is busy checking the following list.

Application listening at the requested port.

See that no application is listening

Reply with a packet that the host is unreachable

When the victimized host receives multiple requests, they will be busy answering all packets and will be unreachable to other clients.

ICMP Flood

Internet Control Message Protocol, commonly known as ping by network analysts, is used in DDoS attacks, which helps attackers send multiple ping requests to targeted hosts and receive back the transmitted packets. Usually, ping requests are used to test whether a host in the network is working or not, but if multiple ping requests are sent to a single server or machine, that will be down. There are several commands which can help in a DDoS attack, like ping -n, ping -t, and ping -I.

SYN Flood

In a regular connection establishment, a client sends a synchronization packet to the server in 1^st step, and in the 2nd step, the server responds with a sync-acknowledgment packet. When the host receives this packet, it replies back in the 3rd step with an ack. But in the case of a DDoS attack 3^rd step is skipped by the host either using a spoofed IP address or using algorithms that help the attacker in not receiving the acknowledgments sent by the targeted host.