Basics of DDoS Attacks
Hi Readers, Distributed Denial of Service also known as DDoS is a type of Distributed Network Attack. This kind of attack makes the application or website flooded with multiple fake requests which makes the website unavailable for some or all users. In this blog, we will see the basics of a DDoS attack and understand how it works.
What is DDoS Attack?
- A DDoS attack is done by an attacker in order to slow down the service by increasing a huge amount of traffic congestion to a specific target application or website and this makes it very difficult for normal users to use the application.
- Genuine users or application owners will see the effect of a DDoS attack as a drastic reduction of speed or complete outage or any other unknown consequences that they are habitual to see in normal operations.
How DDoS attack works?
- Normal traffic flows from online users to the target server using its internet connection.
- In the diagram below, we have normal users represented in clean traffic and bot users in not traffic.
- We’ll have clean traffic that comes through the internet and traverses through the connection from the internet to the target server.
- In this case, traffic flows completely normal, with no slowdown, and no pressure on that traffic flow.
How do attackers Attack?
- Attackers create so much traffic that it causes an inability to flow from the internet to the target server through its connection. Let’s see how it works?
- Attackers make a huge amount of fake network requests to the application which slows down the application and ultimately makes it unavailable for the actual users.
DoS vs DDoS
- DoS attack comes from a single source, and DDoS is the many-source version.
- The “distributed” describes the attack, meaning the traffic comes from many machines (a botnet) at once. This disrupts the service.
Check if Linux Server is under a DDoS attack
Get CPU information on the Linux Server including its uptime and server load,
DESKTOP-0TV2I8S:~# uptime
07:11:29 up 3 min, 0 users, load average: 0.04, 0.02, 0.00
DESKTOP-0TV2I8S:~# top
List all the IPs connecting to your server,
NOTE: In case you don’t see any response from netstat command above, which means there are no active connections.
Get Nitin Mishra’s stories in your inbox
Join Medium for free to get updates from this writer.
In case you are performing a demo or learning, generate some actual traffic first, so you see some active connections,
curl http://google.com
curl http://github.com
curl http://cloudflare.comThis lists all the IPs connecting to our server. This list contains IPs that are either Server’s own IPs or personal IPs. But in case we find any IP which is not known to us and is not in our records, that is something to worry about. In that case, we would want to handle that IP address as that could be a malicious and harmful request.
Blocking malicious IP Addresses
Block localhost with the iptables and verify the rule is added,
DESKTOP-0TV2I8S:/mnt/host/c/Users/Dell# iptables -A INPUT -s 127.0.0.1 -j DROP
DESKTOP-0TV2I8S:/mnt/host/c/Users/Dell# iptables -L -n | grep 127.0.0.1
DROP all -- 127.0.0.1 0.0.0.0/0
DESKTOP-0TV2I8S:/mnt/host/c/Users/Dell#Confirm the server IP is blocked, DROP silently discards the packets instead of sending back a response. A hang screen proves the rule is placed correctly,
DDoS and OSI Layers
Open System Interconnection (OSI) model consists of 7 layers. Out of those layers, the attackers mostly attack the system at layer 3,4 and 7.
- Layer 3, is the Network Layer. It is the Path determination logical unit for the system.
- Layer 4, is the segments unit with end-to-end connection and reliability layer for the system.
- Layer 7, is the application layer, which is responsible for delivering data directly to applications (e.g., HTTP requests)
Note:
- Layer 3 and Layer 4 are considered as Infrastructure layer DDoS attack.
- Layer 7 is considered an application level DDoS attack.
Read more about OSI Model here.
Prevention
1. Reduce the attack surface
Avoid exposing applications or resources to unnecessary ports, protocols, or services. The fewer entry points available, the fewer places an attacker has to probe or exploit.
2. Plan for scalability
Design your architecture to absorb large volumes of traffic rather than buckle under it. A system that can scale horizontally (adding more servers/instances on demand) is far more resilient to sudden traffic spikes, whether legitimate or malicious.
3. Distinguish normal from abnormal traffic
Understand the baseline characteristics of the traffic your application usually receives — typical request rates, geographic distribution, request patterns. With that baseline established, you can compare incoming traffic against it in real time and flag anomalies before they overwhelm your system.
4. Use a CDN or DDoS scrubbing service
Route traffic through a service like Cloudflare, AWS Shield, or Akamai before it reaches your origin server. These services sit in front of your infrastructure, absorbing and filtering large-scale volumetric attacks at the network edge — far beyond what your own server’s iptables rules or fail2ban could handle alone. This is especially important against Layer 3/4 floods, since those attacks aim to saturate your bandwidth before any request-level filtering (like SSO/auth checks or rate-limiting) even comes into play.
That’s all for this blog. Hope you found some information from this. In case of any queries, you can contact me over my email id nitin.mishra1455@gmail.com. To read my other blogs click this.
References
- https://docs.aws.amazon.com/whitepapers/latest/aws-best-practices-ddos-resiliency/introduction-denial-of-service-attacks.html
- https://developers.cloudflare.com/ddos-protection/
- https://sosafe-awareness.com/glossary/ddos-attacks/
- Prompt Engineering for demos and clarification.
Thank you for sticking with me till the end! If you found this blog helpful, please show your appreciation with a clap and share it with others who might find it useful. And if you have any suggestions on how I can improve, I’d love to hear them in the comments.
