What is a DDoS Attack?

Nota editorial (2025): publicado originalmente en 2020. Se añadió una versión estructurada con fines enciclopédicos. El texto original se conserva íntegro como parte del archivo histórico.

On This Day

Several telephone companies have presented service failures in the United States, and some versions point to a DDoS attack as the origin of these failures.

What is a DDoS Attack? A Distributed Denial-of0-Service (DDoS) Attack

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

• Origin: DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices.
• Mechanism: From a high level, a DDoS attack is like a traffic jam clogging up with highway, preventing regular traffic from arriving at its desired destination.

How Does a DDoS Attack Work? The Process of Execution

A DDoS attack requires an attacker to gain control over a network of online machines in order to carry out an attack. Computers and other machines (such as IoT devices) are infected with malware, turning each one into a bot (or zombie). The attacker then has remote control over the group of bots, which is called a botnet.

• Step One: Infect computers and IoT devices to create bots within a network known as a botnet. A single HTTP request from these compromised machines can be cheap on the client side but expensive for the target server due to increased resource demands.
• Target Selection: The attacker directs the group of bots by sending updated instructions, which sends requests towards a victim’s IP address. This may cause the targeted system or network to overflow capacity and result in denial-of-service for normal traffic.

Common Types of DDoS Attacks

Different DDoS attack vectors target varying components of a network connection. Understanding the OSI model is essential to grasp how various types of attacks work and operate on different layers within this framework.

• Application Layer Attacks: These aim at exhausting resources by disrupting web page generation, which responds to HTTP requests. The traffic can be difficult to flag as malicious due to its similarity with legitimate Internet devices.

Preguntas frecuentes

Q: What is a DDoS attack?
A: A distributed denial-of0-service (DDoS) Attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming it with a flood of Internet traffic.

Q: How does a DDoS attack work?
A: A DDoS attack requires an attacker to gain control over a network of online machines in order to carry out the attack. The compromised computers and IoT devices are infected with malware, turning each one into a bot within a group called a botnet.

Q: What is involved in step one of a DDoS attack?
A: Step one involves the creation of bots within a network known as a botnet by infecting computers and IoT devices with malware. These compromised machines are then controlled remotely.

Q: How does an attacker select their target during a DDoS attack?
A: The attacker directs the group of bots by sending updated instructions, which sends requests towards a victim’s IP address. This can cause the targeted system or network to overflow capacity and result in denial-of-service for normal traffic.

Q: What are common types of DDoS attacks?
A: There are different vectors that focus on various components within a network connection. Understanding the OSI model helps to understand how these attacks work and operate at different layers, with application layer attacks being one example.

Q: What is an Application Layer Attack?
A: An Application Layer DDoS attack aims to exhaust resources by disrupting the generation of web pages that responds to HTTP requests. The traffic can often be challenging to flag as malicious due to its resemblance with legitimate Internet devices.

---

Texto original (2020)

On this day, several telephone companies have presented service failures in the United States, and some versions point to a DDoS attack as the origin of these failures.

So, What is a DDoS Attack?

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices. From a high level, a DDoS attack is like a traffic jam clogging up with highway, preventing regular traffic from arriving at its desired destination.

How does a DDoS attack work?

A DDoS attack requires an attacker to gain control of a network of online machines in order to carry out an attack. Computers and other machines (such as IoT devices) are infected with malware, turning each one into a bot (or zombie). The attacker then has remote control over the group of bots, which is called a botnet.

Once a botnet has been established, the attacker is able to direct the machines by sending updated instructions to each bot via a method of remote control. When the IP address of a victim is targeted by the botnet, each bot will respond by sending requests to the target, potentially causing the targeted server or network to overflow capacity, resulting in a denial-of-service to normal traffic. Because each bot is a legitimate Internet device, separating the attack traffic from normal traffic can be difficult.

What are common types of DDoS attacks?

Different DDoS attack vectors target varying components of a network connection. In order to understand how different DDoS attacks work, it is necessary to know how a network connection is made. A network connection on the Internet is composed of many different components or “layers”. Like building a house from the ground up, each step in the model has a different purpose. The OSI model, shown below, is a conceptual framework used to describe network connectivity in 7 distinct layers.

While nearly all DDoS attacks involve overwhelming a target device or network with traffic, attacks can be divided into three categories. An attacker may make use one or multiple different attack vectors, or cycle attack vectors potentially based on counter measures taken by the target.

Application Layer Attacks

The Goal of the Attack:

Sometimes referred to as a layer 7 DDoS attack (in reference to the 7th layer of the OSI model), the goal of these attacks is to exhaust the resources of the target. The attacks target the layer where web pages are generated on the server and delivered in response to HTTP requests. A single HTTP request is cheap to execute on the client side, and can be expensive for the target server to respond to as the server often must load multiple files and run database queries in order to create a web page. Layer 7 attacks are difficult to defend as the traffic can be difficult to flag as malicious.

Application Layer Attack Example:

Vía Cloudfare

See more:

Why are cell phones not working today