6.4Attacks and countermeasures

For a network operator, the ability to correctly diagnose the type of attack from an observed anomaly (a sudden traffic spike, abnormal DNS responses, suspicious traffic within the LAN) and select the appropriate countermeasure is at the heart of incident and fault response. This section builds the understanding of how representative attack techniques work, together with the reasoning pattern for tracing from an observed event to its cause and then to a countermeasure.

6.4.1DoS/DDoS attacks

• A DoS attack aims to make a target service unavailable. A DDoS attack launches the attack simultaneously from many distributed compromised hosts (a botnet, etc.), so because the sources are spread out, simple IP-address blocking is not enough to stop it.
• A SYN Flood attack sends a flood of TCP SYN packets in the three-way handshake without ever completing the connection with an ACK. The server exhausts its half-open connection tracking table, becoming unable to process legitimate connection requests. A countermeasure is SYN cookies, which embed connection information in a cryptographically generated sequence number instead of storing it server-side.
• A reflection attack sends requests with the source IP address spoofed to the victim's IP address to many intermediary servers (DNS servers, etc.), concentrating the responses onto the victim. When the abused protocol's response is larger than the request (DNS, NTP, etc.), this becomes an amplification attack, generating large attack traffic from a small amount of sent traffic.