DoS and DDoS: how to bring a highway to a standstill without a single crash

It's a beautiful morning on the Packet Highway. Cars are moving, toll booths are collecting fees, routers are directing traffic, and the NAT manager has finally found his notebook. Unfortunately, it's the wrong one.

Everything works perfectly. Until a car stops at one of the toll booths.

— Good morning. Can I pay by card?
— Yes.
— And in cash?
— That too.
— By card?
— You just asked that.
— And cash?
— Sir, there's a queue behind you!
— I see. So can I pay by card?

The cashier begins to suspect the driver has no intention of going anywhere. And he's right. This driver did not come to use the highway. He came to make sure nobody else could.

DoS: one spectacularly annoying customer

DoS stands for Denial of Service. It doesn't mean the server has taken offence and decided to stop helping. It means making a service unavailable, or seriously difficult to use, for legitimate users.

On our highway, a single driver might block a booth with endless questions. In a real network, service can be disrupted by exhausting resources or exploiting a weakness in how requests are processed.

An attack doesn't even need enormous amounts of traffic. Sometimes forcing a service to perform particularly expensive operations is enough.

— Could you check the complete history of journeys since 1997, sort it by the vehicle owners' mothers' maiden names, and print three copies?
— Whatever for?!
— Because I'm entitled to ask!
— Can't you just pay the five-pound toll?!
— I'd like the report first.

The cashier disappears into the archives for half an hour. Meanwhile, traffic stops.

DDoS: a family reunion of a hundred thousand cars

The highway administrator sends a security guard over to the booth.

— You're not using this toll road again today.
— Fine.

The car drives away. Traffic moves again. For about four seconds. Then a hundred thousand vehicles appear. Every one stops at a toll booth, rolls down the window, and asks:

— Can I pay by card?

🤣 Now we're dealing with DDoS — Distributed Denial of Service. The essential difference is that the disruptive traffic comes from many distributed sources.

These may be devices enrolled in a botnet: compromised computers, servers, routers, cameras and other Internet-connected equipment. Their owners may have no idea their devices are taking part.

Imagine a security camera guarding a driveway. Most of the day it watches its owner's car, but between recordings it helps block a highway on another continent.

— Boss, the warehouse camera is participating in the attack!
— Which one?!
— The one over the gate.
— It doesn't even have wheels!
— But it does have Internet access.

Three ways to create a traffic jam

Not every DoS or DDoS attack looks alike. On the Packet Highway, there are several ways to paralyse traffic.

1. Block the entire motorway

The first approach is brutally simple: more traffic than a connection can carry. If the road can accommodate a thousand cars per minute and ten thousand try to enter, even the world's fastest cashier won't help.

Cars queue up kilometres before the toll booths. The destination server may have plenty of free memory and an almost idle processor. But what good is that? The packets can't even reach it.

The administrator checks the monitoring graphs.

— CPU five per cent. RAM thirty per cent. Disks are bored.
— Then why is the service down?!
— Because the car park is forty kilometres away and the queue has already reached the Czech border.

This is an example of a volumetric attack, targeting the capacity of the network connection.

2. Occupy every service counter

The second approach overloads the mechanisms that handle traffic and connections. The toll booths are open, the cashiers are working, but every counter is occupied.

Network equipment and servers have limited resources for maintaining connection state and processing traffic. Exhausting those resources can make it hard to serve legitimate customers.

— Next!
— I'd like to start the payment procedure.
— Certainly. Your card, please.
— Not yet.
— Cash, then?
— Not that either.
— What are you waiting for?!
— To start another procedure.

Behind him are five thousand identical cars.

A classic example is a SYN flood, although modern systems contain protections against many traditional variants. We covered TCP connections in our TCP and UDP story.

3. Bury the office in paperwork

The third approach targets the application layer. Requests may look like ordinary user traffic and need not consume huge bandwidth. They only need to make the service work hard.

— I'd like a report of every invoice.
— For which period?
— All of it.
— In what order?
— By amount, date, and then amount again.
— Very well…
— Now start over, but backwards.

Then another customer arrives. And another. And ten thousand more.

The connection is up. The server responds. But real customers can't get through.

Why not just block the IP addresses?

The head of security bursts into the server room.

— I have a solution!
— What is it?
— Block everyone!
— Everyone attacking us?
— EVERYONE!
— But then nobody can use the service.
— And nobody can attack it!
— Congratulations. You've just launched a DoS attack yourself.

🤣 The challenge is distinguishing unwanted traffic from genuine users. Blocking a few addresses may be ineffective against thousands of distributed sources. Some kinds of attacks also involve spoofed source addresses.

Overly aggressive filtering, meanwhile, can shut out innocent visitors. A security policy that closes the entire service certainly has its drawbacks.

Will a bigger server solve it?

— Boss, we bought a new server!
— What kind?
— Sixty-four cores, half a terabyte of RAM, NVMe drives!
— Great. And the network connection?
— The same one.
— Meaning?
— The traffic jam still begins forty kilometres before the toll booth.

More computing power helps when server resources are the bottleneck. If the connection is saturated, filtering only at the server may be far too late.

That's why defence against large DDoS attacks often needs to happen upstream: at the network provider, in specialist filtering infrastructure, or across distributed services. Rate limiting, anomaly detection, CDNs and DDoS protection services can help. There is no magical switch that defeats every attack.

What if it isn't an attack at all?

A massive traffic jam suddenly forms on the Packet Highway. The administrator inspects the graphs.

— Traffic is up twentyfold!
— DDoS?!
— Not necessarily.
— A botnet?!
— Not necessarily.
— Russian hackers?!
— Calm down.

Moments later, a popular website is found to have linked to the service. Thousands of real people are trying to visit at once.

Not every overload is an attack. The symptoms may look similar: delays, errors and missing replies. But the cause and the appropriate response are different. One graph doesn't establish a diagnosis.

— So we're not under attack?
— No. We're just popular.
— Is that good?
— Depends whether we can expand the car park in time.

Finale: absolute security

After a full day dealing with DDoS, the motorway manager calls a meeting.

— Gentlemen, I have a plan that will solve this problem permanently.
— We're listening.
— Close the motorway.

Silence.

— For how long?
— Forever.
— But then nobody can drive through!
— Exactly. No attack will ever overload us again.

The administrator looks at the manager.

— Congratulations. You've achieved a one-hundred-per-cent successful DoS attack against your own infrastructure.
— Thank you.
— That wasn't a compliment.

🤣