Denial of service (DoS/DDoS)

Denial-of-service attacks are usually sorted by the resource they exhaust. Volumetric attacks saturate link bandwidth and are measured in bits per second; protocol or state-exhaustion attacks fill connection tables in servers, firewalls and load balancers and are measured in packets per second; application-layer (layer 7) attacks send valid-looking requests that are expensive to serve, such as uncached search queries or login attempts, and are measured in requests per second. A DDoS spreads the source across many machines, today typically botnets of compromised IoT devices, routers and rented cloud servers, as with Mirai, whose 2016 attack on the DNS provider Dyn disrupted many large sites.

The classic protocol attack is the TCP SYN flood: the attacker sends SYN segments, usually with spoofed source addresses, and the server keeps a half-open entry for each until it times out, as described in RFC 4987. SYN cookies, devised by Daniel J. Bernstein after the 1996 attack on the ISP Panix, encode the connection state in the server's initial sequence number so no memory is allocated until the handshake completes. Slowloris-type attacks exhaust worker threads by holding HTTP connections open with deliberately slow headers, and the HTTP/2 Rapid Reset technique (CVE-2023-44487) abused stream cancellation to generate record request rates.

Reflection and amplification rely on connectionless UDP services that answer a small spoofed request with a much larger response sent to the victim. The amplification factor varies widely by protocol: DNS and NTP (the monlist command) gave large multipliers, and exposed memcached servers produced the extreme factors behind the 2018 attack on GitHub. The root enabler is IP source spoofing, which BCP 38 (RFC 2827) ingress filtering would prevent if networks deployed it universally.

Mitigation combines capacity and filtering. Anycast networks and CDNs spread load across many sites; upstream scrubbing centres divert traffic by BGP or DNS and return cleaned traffic; operators can use remotely triggered black-holing (the BLACKHOLE community, RFC 7999) or BGP Flowspec (RFC 8955) to drop attack traffic upstream, at the cost of also dropping legitimate traffic to the blackholed prefix. Layer 7 attacks need rate limiting, caching, challenge pages and WAF rules. A common failure mode is protecting the website but not the DNS servers, VPN gateway or API that the service also depends on.

Unlike ransomware, a DoS attack does not touch data and usually ends when traffic stops, but it directly attacks availability. Under NIS2 Art. 23 an attack that causes severe operational disruption can be a significant incident with a 24-hour early warning, and Danish public websites have repeatedly been targeted by politically motivated hacktivist DDoS campaigns.