# Denial of Service (DoS) and Distributed Denial of Service (DDoS)

> Chapter 10 of the Courseiva EC-CEH curriculum — https://courseiva.com/learn/ec-ceh/denial-of-service

**Official objective:** 5.3 — Understand DoS/DDoS attack methods, tools, and mitigation strategies.

## Introduction

If a company's website goes down during Black Friday sales, it loses not just millions of dollars in revenue but also the trust of every customer who couldn't complete their purchase. That is the real-world consequence of failing to understand how Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks work. For anyone studying for the CEH 312-50 exam, knowing these attack methods is critical because they are one of the most common and disruptive threats any organisation faces, and the exam will test whether you can distinguish between attack types, recognise the tools used, and remember the basic mitigation steps.

## The Restaurant Flood Analogy

10,000 people walk into a small restaurant at exactly the same moment. The restaurant only has one waiter, one chef, and a tiny kitchen that can cook five meals at a time. That single waiter is overwhelmed by the rush of orders — he can't even process a single request properly because every second a new person is shouting their order at him. The chef in the kitchen is completely blocked from cooking anyone's food because the waiter never stops shouting new orders long enough to deliver them to the kitchen. The restaurant's phone line is ringing off the hook with takeaway orders, but nobody can answer it because all the staff are trying to deal with the impossible crowd. The result is that no customer — even the one who just wanted to order a single glass of water — gets served. The restaurant isn't broken; it still has tables, chairs, and food in the fridge. But the restaurant is effectively dead to everyone trying to eat there because the single entrance, the single waiter, and the single kitchen have been “flooded” with more than they can handle.

A DoS attack works exactly like this. It sends a flood of fake requests to a single target (the restaurant) from a single source computer (the lone troublemaker who rounded up all those fake customers). A DDoS attack is worse: it uses a whole army of infected computers (a botnet) to send those floods from thousands of different locations simultaneously. The restaurant’s door is the web server's network connection; the waiter is the CPU; the kitchen is the server's memory. Overwhelm any of these resources, and the entire service stops working for everyone — including legitimate customers.

## Core explanation

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are malicious attempts to make a computer resource, like a web server or an entire network, unavailable to its intended users. The central idea is simple: do whatever it takes to consume all of a target's finite resources — bandwidth, processing power (CPU), memory (RAM), disk I/O, or open connections — so that legitimate users cannot access the service.

A standard DoS attack comes from a single source. The attacker sends a huge volume of traffic or a specially crafted packet that exploits a weakness in the software. For example, one classic technique is a “Ping of Death,” where the attacker sends a malformed IP packet that is larger than the maximum size the target’s operating system can handle. When the target tries to reassemble the packet, its system crashes or reboots, denying service to everyone. Another common DoS attack is “SYN Flood.” In a normal connection, when a client wants to connect to a server, it sends a “SYN” (synchronise) packet. The server replies with a “SYN-ACK” packet and reserves a small amount of memory to wait for the client’s final “ACK” (acknowledgement) to complete the three-way handshake. In a SYN flood, the attacker sends thousands of SYN packets with fake source IP addresses. The server sends SYN-ACKs to these fake addresses (which never reply), so it keeps reserving memory until it runs out. Once the server’s connection table is full, it can no longer accept new connections from anyone, including real customers.

DDoS attacks are much more powerful. The attacker controls a network of compromised computers called a “botnet.” A botnet can contain tens of thousands of individual machines (laptops, servers, or even IoT devices like security cameras) that have been infected with malware without their owners knowing. The attacker sends a single command to the botnet, and every infected machine simultaneously sends traffic to the target. A single home computer might generate a few hundred megabits per second of traffic, but a botnet of 10,000 machines can generate hundreds of gigabits per second — more than enough to saturate most business internet links.

The most famous DDoS attack method is a “volumetric attack,” which aims to consume all available bandwidth between the target and the rest of the internet. One specific technique is a “DNS amplification attack.” The attacker sends a small DNS query to a public DNS server, but they “spoof” (forge) the source IP address to be the victim’s IP address. The DNS server then sends a large response (the amplification factor can be 50x to 100x larger than the request) to the victim. The attacker only needs a small botnet to generate a massive flood of traffic aimed at the victim’s network pipe.

Another important category is application-layer attacks. These target the most resource-intensive part of a web application. For example, a “Slowloris” attack opens many connections to a web server but never completes the HTTP request headers. The server keeps each connection open, waiting for the request to finish, until it uses up all available connections. Legitimate users cannot connect because the server’s connection pool is full of half-open requests.

Why does this exist? Attackers use DoS/DDoS for several motives: extortion (pay us or we take you down), hacktivism (political protest against a company or government), competitive sabotage (taking down a rival’s e-commerce site during a sale), or simply as a distraction while they carry out a more targeted intrusion elsewhere.

What does DoS/DDoS replace? It replaces the need for physical sabotage. Before the internet, if you wanted to shut down a competitor, you would have to physically vandalise their building or cut their phone lines. Now, an attacker in another country with a laptop can achieve the same result from their bedroom.

Mitigation strategies include:
- Rate limiting: configuring firewalls to allow only a certain number of requests per second from any single IP address.
- Traffic filtering: dropping packets that are malformed, like those with spoofed IP addresses or unusual flags.
- Load balancing: distributing incoming traffic across multiple servers so no single server is overwhelmed.
- Anycast networks: spreading the same IP address to multiple data centres around the world so that traffic is automatically routed to the closest or least congested location.
- Cloud-based DDoS protection services (like Cloudflare or AWS Shield): these services absorb the flood traffic in their massive global network before it reaches your actual server.

## Real-world context

An IT professional, like a security operations centre (SOC) analyst or a network engineer, encounters DoS/DDoS attacks regularly. Let’s walk through a realistic scenario.

Imagine you are the sole IT security manager for an online retailer called “ShopSphere,” which sells electronics. It is 10:00 AM on a Tuesday in November, two weeks before Black Friday. Suddenly, your monitoring dashboard lights up with alerts. The company’s website is responding very slowly, and the main web server’s CPU usage is at 99%. You check the inbound traffic graph and see a huge spike — normally you see 500 Mbps of traffic, but now it’s at 30 Gbps. You have a 10 Gbps internet connection, so the link is completely saturated.

Step 1: You quickly identify the type of traffic. You look at the firewall logs and see that the vast majority of connections are coming from a few thousand different IP addresses, all requesting the same product page. This pattern looks like a Layer 7 DDoS attack targeting the application layer, specifically the product search feature, which is costly to serve because it queries a database.

Step 2: You activate your emergency response plan. You call your internet service provider (ISP) to route the traffic through your cloud-based DDoS protection service provider (like Cloudflare or Akamai). This can take 10-15 minutes to implement. In the meantime, you manually apply a rate limiting rule on the web application firewall (WAF) to allow only 50 requests per second from any single IP address. You also block all traffic from the top five offending countries if your business does not serve customers there.

Step 3: You check if the attackers are using a known attack vector. You see that the requests are using a custom HTTP header that looks suspicious. You write a custom web application firewall rule to drop any packet with that header. This stops the attack almost immediately for a few minutes.

Step 4: You communicate with the business stakeholders. You send a message to the CEO and the customer support team saying: “We are experiencing a DDoS attack. The website is intermittently available. We are actively mitigating. Customers may see a “Service Unavailable” error. We will update you in 30 minutes.”

Step 5: Once the cloud DDoS protection service is active, all traffic is redirected through their scrubbing centres. The attack traffic is filtered out, and only legitimate traffic passes to your server. Your website becomes stable again within an hour. After the attack ends, you write a post-mortem report analysing the attack’s characteristics: the source IPs, the targeted pages, the duration (2 hours), and the volume (peaked at 500 Gbps). You then implement permanent changes: you add a content delivery network (CDN) to cache static assets, you implement a CAPTCHA challenge on the search page to slow down automated bots, and you upgrade your bandwidth contract to 100 Gbps with burst capability for future Black Friday traffic.

In a SOC role, you would use tools like Wireshark to capture and analyse attack packets, netstat to see active connections, and SIEM (Security Information and Event Management) platforms like Splunk to correlate logs. You would also run DDoS simulation tests (called “stress testing” or “pentesting”) to see if your defences hold up.

## Exam focus

The CEH 312-50 exam tests DoS/DDoS concepts in three main ways: definition recognition, attack identification, and mitigation matching. You will see multiple-choice questions that give you a scenario and ask you to identify the type of attack being described. The exam loves to test your ability to distinguish between DoS and DDoS, between volumetric and application-layer attacks, and between different amplification vectors.

Key concepts you MUST memorise for the exam:

- The definition of DDoS: an attack that uses multiple compromised systems (often thousands) to target a single system.
- The definition of DoS: an attack from a single source that makes a system unavailable.
- SYN Flood: the most classic DoS attack that exploits the TCP three-way handshake. The attacker sends many SYN packets with fake source IPs and never completes the handshake. The server’s connection table fills up.
- Ping of Death: sending a malformed packet larger than 65,535 bytes, causing the target to crash.
- Smurf Attack: sending a ping request with a spoofed source IP (the victim’s IP) to a broadcast address of a network. All devices on that network reply to the victim, overwhelming it. (Note: modern networks often disable directed broadcasts, so this is less common now).
- DNS Amplification: small DNS query to an open resolver with a spoofed source IP; the large DNS response is sent to the victim. Magnification factor can be 50-100x.
- Slowloris: an application-layer attack that holds many HTTP connections open by sending partial requests, consuming server connection slots.
- Botnet: the network of compromised computers (zombies) used in a DDoS attack. The command and control (C&C) server is used by the attacker to issue commands.
- Reflection attack: the attacker sends a request with a spoofed source IP, causing other servers to “reflect” responses to the victim. Amplification happens when the response is larger than the request.

Common traps the exam sets:
- They give a description of a DDoS but ask what the “attack type” is — and one option is “Botnet.” Botnet is the infrastructure, not the attack type. The attack type is “DDoS” or “SYN Flood.”
- They ask for the “primary mitigation” for a volumetric DDoS. Many beginners answer “block the attacker’s IP.” That is wrong because the IPs are often spoofed or come from thousands of different real IPs. The correct answer is typically “using a cloud-based DDoS protection service” or “rate limiting.”
- They test you on the differences between “Smurf” and “Fraggle” attacks. Smurf uses ICMP (ping), while Fraggle uses UDP (echo). This is a a favourite trick question.
- They ask about “amplication factor” for DNS amplification. Memorise that it is often 50 to 100 times the original request size.

Define to memorise:
- Buffer overflow: an attack that sends more data than a buffer can hold, overwriting adjacent memory and potentially crashing the system. Some DoS attacks use buffer overflows.
- Capacity consumption: the core concept of DoS — consuming bandwidth, memory, or processing power so that the system cannot handle legitimate requests.
- Mitigation tools: Cisco Guard, Arbor Networks, Cloudflare, AWS Shield, Rate Limiting, Blackholing/Sinkholing (where the ISP drops all traffic to the victim’s IP).

## Step by step

1. **Reconnaissance and Weaponisation** — The attacker identifies the target (e.g., a company’s public web server IP). If using a DDoS, they first build or acquire a botnet by infecting vulnerable devices (IoT cameras, home routers, or PCs) with malware. For a DoS, they simply prepare the attack tools on a single machine.
2. **Delivery and Exploitation** — The attacker sends the attack traffic to the target. For a SYN flood, the attacker sends thousands of SYN packets with spoofed IPs. For a DNS amplification attack, the attacker sends small queries to open DNS resolvers with the victim’s spoofed IP as the source, causing those resolvers to flood the victim with large responses.
3. **Resource Exhaustion** — The target’s finite resources (bandwidth, CPU, memory, connection slots) are consumed by the malicious traffic. For example, in a SYN flood, the server’s connection backlog queue fills up. In a volumetric flood, the network link becomes saturated, causing packet loss for all traffic.
4. **Denial of Service** — Once the target’s resources are exhausted, legitimate users can no longer connect or receive responses. The server may crash, become unresponsive, or drop all new connection requests. The intended service is effectively denied to its authorised users.
5. **Detection and Mitigation by Defender** — The victim’s security team identifies the attack via monitoring tools (e.g., traffic spikes on graphs, CPU alerts). They apply countermeasures such as activating cloud DDoS scrubbing, creating firewall rules to drop specific patterns, or temporarily blackholing traffic to the targeted IP (which stops the attack but also stops legitimate traffic).
6. **Post-Attack Analysis and Hardening** — After the attack subsides, the defender analyses logs and packet captures to understand the attack vector. They then implement long-term fixes like applying rate limits, updating software to patch vulnerabilities, or integrating an always-on DDoS protection service to prevent recurrence.

## Comparisons

### DoS (Denial of Service) vs DDoS (Distributed Denial of Service)

**DoS (Denial of Service):**
- Comes from a single source IP address.
- Easier to mitigate by blocking that IP or rate limiting the single source.
- Often lower traffic volume, limited by the attacker’s own internet connection.

**DDoS (Distributed Denial of Service):**
- Comes from multiple distributed sources (botnet).
- Much harder to mitigate because blocking individual IPs is impractical.
- Can generate massive traffic volumes (hundreds of Gbps) using many devices.

### Volumetric Attack vs Application-Layer Attack

**Volumetric Attack:**
- Aims to saturate the target’s bandwidth with high traffic volume.
- Examples: DNS amplification, UDP flood, ICMP flood.
- Mitigated by cloud-based scrubbing services and rate limiting at network level.

**Application-Layer Attack:**
- Targets specific application resources (CPU, memory, connection slots) with low traffic volume.
- Examples: Slowloris, HTTP flood targeting a specific query.
- Mitigated by web application firewalls (WAF), CAPTCHAs, and load balancing.

### Smurf Attack vs Fraggle Attack

**Smurf Attack:**
- Uses ICMP (ping) packets.
- Sends a ping request to a network broadcast address with a spoofed victim source IP.
- All devices on the network reply to the victim, flooding it with ICMP replies.

**Fraggle Attack:**
- Uses UDP (User Datagram Protocol) packets.
- Sends a UDP echo request to a broadcast address with a spoofed victim source IP.
- All devices reply to the victim with UDP echo responses, flooding it with UDP traffic.

### SYN Flood vs Ping of Death

**SYN Flood:**
- Exploits the TCP three-way handshake by sending many SYN packets with spoofed IPs.
- Targets the server’s connection table and memory.
- Mitigated by SYN cookies and limiting the number of half-open connections.

**Ping of Death:**
- Exploits a buffer overflow by sending a single malformed IP packet larger than 65,535 bytes.
- Targets the operating system’s IP stack.
- Mitigated by patching the OS to reject oversized packets (modern OS are immune).

### Reflection Attack vs Amplification Attack

**Reflection Attack:**
- The attacker sends a request with a spoofed source IP (the victim’s IP) to a legitimate server.
- The legitimate server sends its response to the victim (reflection).
- Reflection alone does not multiply the traffic size; it just redirects it.

**Amplification Attack:**
- A reflection attack where the response is significantly larger than the request (amplification factor).
- Examples: DNS amplification (50-100x), NTP amplification (up to 1000x).
- The goal is to maximise the amount of traffic hitting the victim relative to the attacker’s effort.

## Diagram

_A flowchart showing how an attacker controls a botnet via a C&C server to flood the target with traffic, blocking legitimate users, while a DDoS protection service scrubs the traffic._

```mermaid
flowchart TD
    A[Attacker] --> B[Command & Control Server]
    B --> C[Botnet - thousands of infected devices]
    C --> D|Flood of traffic| E[Target Server]
    D --> F|Legitimate User 1|
    F -- blocked --> E
    G[Legitimate User 2] -- blocked --> E
    E --> H[Service Denied]
    I[DDoS Protection Service] --> J[Scrubbing Centre]
    J --> K[Clean traffic to target]
```

## Common misconceptions

- **Misconception:** A DoS attack and a DDoS attack are basically the same thing; the terms are interchangeable. **Reality:** They are different. A DoS attack comes from a single source (one computer or IP address). A DDoS attack comes from multiple distributed sources (a botnet of many compromised machines). DDoS attacks are much harder to stop because you cannot just block a single IP address. (The acronyms look similar, and many news articles use “DDoS” as a catch-all. Beginners often miss the fundamental “distributed” vs “single source” distinction, which the exam explicitly tests.)
- **Misconception:** If I just block the IP address of the attacker, the attack will stop. **Reality:** In a DoS attack, the source IP is often spoofed (faked), so blocking that IP does nothing. In a DDoS attack, there are thousands of real IPs (compromised devices), so blocking them one by one is impossible. The correct mitigation involves rate limiting, cloud scrubbing, or filtering by traffic patterns. (People naturally think of “block the bad guy” because that is how we deal with threats in everyday life. They do not realise that attackers can fake their identity or use an army of unwilling participants.)
- **Misconception:** A DDoS attack only affects the target company's server; the end users are fine. **Reality:** A DDoS attack prevents legitimate users (customers) from accessing the target’s service. For example, if a bank’s website is under DDoS, customers cannot log in to check their balance or make transfers. The impact is shared between the target and its users. (Beginners think the attack is “just a server problem.” They forget that the server exists to serve users, so when the server is unavailable, users suffer directly.)
- **Misconception:** DDoS attacks are always very high bandwidth (volumetric) floods. **Reality:** DDoS attacks can also be low-bandwidth application-layer attacks (like Slowloris) that target specific software vulnerabilities or resource limits. These attacks can bring down a server with very little traffic by exhausting connection pools or CPU. (The most famous DDoS attacks (like the 2016 Mirai botnet attack) are described as huge volumetric floods. Beginners assume that’s the only type, missing the “slow and subtle” application-layer variety.)
- **Misconception:** Firewalls alone are sufficient to stop all DDoS attacks. **Reality:** Firewalls can block some types of attacks (like filtering malformed packets), but they are often overwhelmed by high-volume floods because the firewall itself has limited processing capacity. Most firewalls are stateful, meaning they track connection states, which can be exhausted. DDoS protection requires additional layers like rate limiting, load balancers, and cloud-based scrubbing centres. (People hear “firewall” as a general “safety net” and assume it is a catch-all solution. They do not understand that the firewall is also a computer that can be overwhelmed.)
- **Misconception:** Only large corporations or governments get DDoSed. **Reality:** Small businesses, personal blogs, and even individual gamers can be targets. Attackers often use small targets for practice, extortion, or personal grudges. Botnets do not discriminate; they scan the entire internet for vulnerabilities. (Mainstream media covers high-profile DDoS attacks on giants like Amazon or Bank of America. Beginners assume “it won’t happen to me,” but the CEH exam expects you to know that any system connected to the internet is a potential target.)

## Key takeaways

- A DoS attack uses a single source to overwhelm a target, while a DDoS attack uses a botnet of thousands of compromised devices to achieve the same goal from many locations simultaneously.
- The three-way TCP handshake (SYN, SYN-ACK, ACK) is exploited in SYN flood attacks by sending incomplete connections that fill the server's memory buffer.
- Amplification attacks like DNS amplification work by sending a small request with a spoofed victim IP to a public server, which then sends a much larger response to the victim, magnifying traffic by up to 100 times.
- Application-layer DDoS attacks like Slowloris require very little bandwidth but can be devastating because they target the server’s limited connection pool or CPU resources.
- Mitigation strategies include rate limiting, cloud-based DDoS protection services, anycast networks, and load balancing; blocking individual IP addresses is ineffective against distributed or spoofed attacks.
- Botnet command and control (C&C) servers are used by attackers to instruct infected zombie machines to launch coordinated traffic against a specific target IP.
- The exam loves to test the difference between a Smurf attack (ICMP ping to broadcast address) and a Fraggle attack (UDP echo to broadcast address) — memorise which uses ICMP and which uses UDP.

## FAQ

**Can a DDoS attack permanently destroy my server hardware?**

No, DDoS attacks do not physically damage hardware. They overwhelm the software and network resources, causing the server to crash or become unresponsive, but once the attack stops and you reboot, the hardware is generally fine unless the overheating or resource strain caused a secondary fault (rare).

**What is the difference between a SYN flood and a ping flood?**

A SYN flood exploits the TCP three-way handshake by sending fake SYN packets and never completing connections, exhausting the server’s connection table. A ping flood sends a high volume of ICMP echo requests (pings) to saturate bandwidth or CPU. SYN flood targets connection slots; ping flood targets bandwidth.

**Is it illegal to launch a DDoS attack?**

Yes, launching a DDoS attack is illegal in most countries under computer misuse laws (e.g., the Computer Fraud and Abuse Act in the US, the Computer Misuse Act in the UK). It is considered a criminal offense and can result in fines and imprisonment.

**How do attackers get a botnet?**

Attackers infect devices with malware through phishing emails, exploiting software vulnerabilities, or using default passwords on IoT devices. Once infected, the device connects to a command and control (C&C) server that the attacker controls, and the attacker can then instruct all infected devices to launch attacks simultaneously.

**Can a DDoS attack be traced back to the attacker?**

Tracing a DDoS attack is very difficult because the source IP addresses are often spoofed (faked) or belong to compromised machines that the attacker does not own. Attackers also use anonymising services like Tor or bulletproof hosting to hide their true location. However, with enough resources and cooperation from ISPs, law enforcement can sometimes trace the command and control infrastructure.

**What does “blackholing” mean in DDoS mitigation?**

Blackholing is a method where the ISP routes all traffic destined for the victim’s IP address into a null interface (a “black hole”), dropping it entirely. This stops the attack traffic, but it also stops all legitimate traffic to that IP, effectively taking the target completely offline. It is a last-resort measure.

## Check your understanding

1. **What is the primary difference between a DoS attack and a DDoS attack?**

   Answer: A DoS attack originates from a single source, while a DDoS attack originates from multiple distributed sources (a botnet).

2. **Which TCP handshake packet does an attacker send in a SYN flood attack that causes the server to reserve resources?**

   Answer: The attacker sends the initial SYN (synchronise) packet with a spoofed source IP address, causing the server to allocate memory for a half-open connection.

3. **What is the amplification factor typically associated with a DNS amplification attack?**

   Answer: The amplification factor can be between 50 and 100 times, meaning the DNS response can be 50 to 100 times larger than the attacker’s original query.

4. **How does a Slowloris attack differ from a volumetric DDoS attack?**

   Answer: Slowloris is an application-layer attack that sends partial HTTP headers to keep many connections open, consuming server connection slots with very little bandwidth, whereas a volumetric attack floods the network with high traffic volume.

5. **Why is blocking the attacker’s IP address often ineffective against a DDoS attack?**

   Answer: In a DDoS, the source IPs are either spoofed (faked) or belong to thousands of different compromised machines, so blocking a single IP does not stop the attack.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/ec-ceh/denial-of-service