DDoS Attack Mechanics

Layer 4: the TCP SYN flood

A layer 4 denial-of-service attack targets the transport layer, and the classic form is the SYN flood.

The TCP three-way handshake

Establishing a TCP connection takes three messages:

1. The client sends a SYN (synchronise) packet to the server.
2. The server replies with a SYN-ACK (synchronise-acknowledge) packet.
3. The client completes the handshake with an ACK (acknowledge) packet.

Only once the handshake completes can layer 7 begin transmitting data.

The attack

1. The attacker sends a large number of SYN packets, usually with spoofed source addresses.
2. The server responds with a SYN-ACK to each.
3. The attacker never sends the final ACK.
4. The server holds each half-open connection, reserving memory in the connection table while it waits.
5. The table fills, and legitimate clients can no longer connect.

The cost asymmetry is what makes it work: the attacker spends one small packet, the server spends a connection-table slot and a timeout.

Amplification and reflection

Amplification attacks abuse protocols where the response is much larger than the request, and where the request can be sent over UDP with a forged source address.

Protocols commonly abused:

• DNS (Domain Name System)
• NTP (Network Time Protocol) — the MONLIST command in particular
• SSDP (Simple Service Discovery Protocol)
• SNMP (Simple Network Management Protocol)
• CharGEN (Character Generation Protocol)

How it works

1. The attacker spoofs the victim’s IP address as the source of the request.
2. The attacker identifies open, misconfigured third-party servers — the reflectors.
3. The attacker sends small requests to many reflectors, crafted to produce the largest possible response.
4. The reflectors send those responses to the victim, which never asked for them.

The victim absorbs traffic several times the volume the attacker sent, and the traffic appears to come from thousands of legitimate servers rather than from the attacker. The amplification factor is the response size divided by the request size; it varies by protocol and by the specific query, and for the worst-affected protocols it is large enough that a modest attacker link can saturate a much bigger one.

DNS amplification in detail

The attacker sends a query designed to return as much data as possible — historically an ANY query for a domain with many records — to an open resolver, with the victim’s address as the source. The resolver sends the large answer to the victim. Repeated across many resolvers simultaneously, the aggregate is what takes the target down.

Layer 7: the request flood

A layer 7 attack floods a web server with HTTP GET or POST requests, usually from a botnet. Each request is individually legitimate, which is what makes filtering hard: the traffic volume may be modest while the work it causes is not. A single request can trigger a database query, a template render and several backend calls, so the server, the application and the database all saturate before the network does.

Countermeasures

Against SYN floods

• SYN cookies, so the server holds no state until the handshake completes
• Rate limiting of inbound SYN packets
• Appropriate connection timeout values
• AWS Shield, which mitigates this class automatically at the edge

Against amplification and reflection

• Do not run an open resolver: restrict recursion to known clients, and rate-limit responses
• Disable legacy commands such as NTP MONLIST
• Filter spoofed source addresses at the network edge (BCP 38)
• Absorb what does arrive at the edge rather than at the origin, using CloudFront and Route 53

Against layer 7 floods

• AWS WAF rate-based rules, bot control, and the CAPTCHA and Challenge actions
• Caching at CloudFront so that repeated requests never reach the origin
• Auto Scaling to absorb a surge, with the cost implications understood in advance
• AWS Shield Advanced, whose automatic application-layer mitigation generates AWS WAF rules during an attack

See DDoS attacks and AWS protection strategies for the architecture that puts these together, and AWS Shield for the difference between the two Shield tiers.