Reference

DDoS Definitions

Precise, engineer-grade definitions of the attack vectors, defensive controls, and methodology terms that come up in DDoS testing.

Attack Vectors

ACK Flood

An ACK flood is an L4 attack that sends TCP ACK packets matching no open connection, forcing stateful firewalls and conntrack tables to waste lookups.

Read definition

Application-Layer Attack

An application-layer attack is an L7 DDoS class of valid but costly requests that exhaust CPU and backends at low bandwidth, evading volumetric filters.

Read definition

Carpet Bombing

A carpet bombing attack spreads a volumetric flood across many IPs in a subnet at once, staying under per-IP thresholds to evade detection.

Read definition

CHARGEN Amplification

A CHARGEN amplification attack spoofs the victim IP to legacy UDP 19 services, which reply with large character streams, building a volumetric flood.

Read definition

CLDAP Amplification

A CLDAP amplification attack spoofs the victim IP to exposed LDAP servers on UDP 389, which reply 50x to 70x larger to build a volumetric flood.

Read definition

Direct-to-Origin (D2O) DDoS Attack

A DDoS technique in which the attacker sends attack traffic straight at a discovered origin IP, bypassing the CDN, WAF, or scrubbing layer so edge mitigation never touches the flood.

Read definition

DNS Amplification

A DNS amplification attack spoofs the victim IP to open resolvers, which return far larger responses, building a volumetric flood of hundreds of Gbps.

Read definition

DNS Flood

A DNS flood is an L7 attack that aims high volumes of direct queries at authoritative or recursive servers, exhausting them until name resolution stops.

Read definition

DNS Water Torture

A DNS water torture attack floods resolvers with random nonexistent subdomains, forcing every query down to the victim's authoritative DNS servers.

Read definition

Fraggle Attack

A Fraggle attack is a UDP reflection vector that spoofs the victim IP in packets to a broadcast address, so every host on it floods the victim at once.

Read definition

GRE Flood

A GRE flood is an L3 volumetric attack that sends high rates of GRE-encapsulated packets (IP protocol 47) to exhaust the target's link and CPU.

Read definition

HTTP Flood

An HTTP flood is an L7 attack that sends high volumes of valid-looking GET or POST requests, exhausting CPU, worker threads, and the database tier.

Read definition

HTTP/2 Rapid Reset

HTTP/2 Rapid Reset (CVE-2023-44487) is an L7 attack that opens and instantly cancels streams at scale, driving record request floods over few connections.

Read definition

ICMP Flood (Ping Flood)

An ICMP flood (ping flood) is an L3 volumetric attack that sends high rates of ICMP packets, saturating link capacity and CPU on the responding host.

Read definition

IP Fragmentation Attack

An IP fragmentation attack floods a target with incomplete or overlapping IP fragments, exhausting the kernel reassembly buffer at low packet rates.

Read definition

LAND Attack

A LAND attack sends a TCP SYN with source IP and port equal to the destination, making a vulnerable host reply to itself in a loop until it hangs.

Read definition

mDNS Amplification

An mDNS amplification attack spoofs the victim IP to open multicast DNS responders on UDP 5353, which reflect larger replies into a volumetric flood.

Read definition

Memcached Amplification

A memcached amplification attack reflects a small spoofed UDP request off open port 11211 servers into a flood, the highest known amplification factor.

Read definition

NetBIOS Amplification

A NetBIOS amplification attack spoofs the victim IP to name-service hosts on UDP 137, which reflect larger replies into a volumetric flood.

Read definition

NTP Amplification

An NTP amplification attack abuses the monlist command on open NTP servers to reflect a tiny spoofed query into a response hundreds of times larger.

Read definition

Ping of Death

A ping of death is an L3 attack sending an oversized ICMP packet that overflows the reassembly buffer, crashing or hanging a vulnerable host.

Read definition

Portmap Amplification

A portmap amplification attack spoofs the victim IP to rpcbind hosts on UDP 111, which reflect larger replies into a volumetric flood.

Read definition

Protocol Attack

A protocol attack is a DDoS class that exhausts stateful tables in firewalls and kernels with packet floods, measured in packets per second.

Read definition

Pulse Wave Attack

A pulse wave attack delivers short repeated bursts of high-volume traffic, exploiting the reaction window before scrubbing fully engages.

Read definition

QUIC Flood

A QUIC flood is an L4 attack that floods a server with QUIC handshake packets on UDP 443, forcing costly crypto and connection-state setup.

Read definition

Ransom DDoS (RDDoS)

A ransom DDoS (RDDoS) is an extortion attack that floods a target, or threatens to, unless a cryptocurrency payment is made to stop or avert it.

Read definition

RST Flood

An RST flood is an L4 attack that sends spoofed TCP RST packets, forcing the target and inline stateful devices to burn CPU on connection-table lookups.

Read definition

RUDY Attack (R-U-Dead-Yet)

A RUDY (R-U-Dead-Yet) attack is an L7 slow-POST attack that dribbles a large request body byte by byte, tying up worker threads at low bandwidth.

Read definition

Slowloris

Slowloris is an L7 slow attack that holds many connections open with partial HTTP requests sent slowly, exhausting the connection pool at low bandwidth.

Read definition

Smurf Attack

A smurf attack is an L3 reflection vector that spoofs the victim IP in ICMP echoes to a broadcast address, so every host floods the victim at once.

Read definition

SNMP Amplification

An SNMP amplification attack spoofs the victim IP to devices on UDP 161 with default community strings, reflecting GetBulk replies into a flood.

Read definition

SSDP Amplification

An SSDP amplification attack spoofs the victim IP to UPnP devices on UDP 1900, which reply far larger, building a volumetric flood from many reflectors.

Read definition

SSL Flood (TLS Handshake Flood)

An SSL flood is an L7 attack that forces repeated TLS handshakes to exhaust server CPU on asymmetric crypto, stalling the service at low bandwidth.

Read definition

SYN Flood

A SYN flood is an L4 attack that sends TCP SYN packets without completing the handshake, exhausting the SYN backlog so legitimate connections fail.

Read definition

TCP Connection Flood

A TCP connection flood opens many full TCP connections and holds them idle, exhausting socket and conntrack tables so new connections fail.

Read definition

TCP Middlebox Reflection

A TCP middlebox reflection attack abuses censorship and firewall middleboxes to reflect amplified TCP traffic at a spoofed victim IP.

Read definition

Teardrop Attack

A teardrop attack sends overlapping or malformed IP fragments so a vulnerable reassembly routine miscalculates buffers and crashes the target host.

Read definition

TFTP Amplification

A TFTP amplification attack spoofs the victim IP to open TFTP servers on UDP 69, which reflect far larger file replies into a volumetric flood.

Read definition

TLS Renegotiation Attack

A TLS renegotiation attack forces repeated handshakes to exhaust server CPU on asymmetric crypto, saturating compute at very low bandwidth.

Read definition

UDP Flood

A UDP flood is an L4 volumetric attack that sends high rates of datagrams to closed ports, forcing ICMP unreachable replies that saturate CPU and link.

Read definition

UDP Reflection / Amplification

A UDP reflection/amplification attack spoofs the victim IP to misconfigured servers that reply with far larger responses, multiplying attack bandwidth.

Read definition

Volumetric Attack

A volumetric attack is a DDoS class that saturates the network link in bits per second, dropping legitimate packets before they reach the origin.

Read definition

WS-Discovery Amplification

A WS-Discovery amplification attack spoofs the victim IP to IoT devices on UDP 3702, which reply far larger, building a high-factor volumetric flood.

Read definition

Defenses & Controls

ACL (Access Control List)

An ACL (access control list) is a network control that permits or denies packets by IP, port, or protocol, dropping bad traffic at the router or firewall.

Read definition

Always-On Mitigation

Always-on mitigation routes all traffic through scrubbing at all times, removing the detection-and-cutover delay that on-demand DDoS protection incurs.

Read definition

BCP 38 (Ingress Filtering)

BCP 38 is an ingress-filtering standard that drops packets with spoofed source IPs at the edge, preventing reflection and amplification attacks.

Read definition

BGP Flowspec

BGP Flowspec is a control that distributes packet-filter rules across routers via BGP, dropping DDoS flows by port, protocol, or size at the edge.

Read definition

Block vs Count Mode

Block-vs-count mode is the WAF setting deciding whether a matched rule drops a request or only logs it; a rule left in count mode is absent under attack.

Read definition

Bot Management

Bot management is an L7 control that classifies clients by fingerprint and behavior, filtering automated DDoS traffic while passing real users.

Read definition

CDN (Content Delivery Network)

A CDN (content delivery network) is a distributed edge that caches content and absorbs volumetric DDoS load across many points of presence.

Read definition

Challenge-Response

A challenge-response control interrupts suspect clients with a test (JS, CAPTCHA, or proof-of-work) that bots fail, filtering automated DDoS traffic.

Read definition

Clean Pipe

A clean pipe is a managed DDoS service that routes traffic through a scrubbing provider, returning only filtered clean traffic to the origin link.

Read definition

Conntrack Exhaustion

Conntrack exhaustion is a failure where a flood fills the kernel connection-tracking table, so stateful firewalls drop new legitimate flows.

Read definition

Deep Packet Inspection (DPI)

Deep packet inspection (DPI) is a control that examines packet payloads, not just headers, to identify and drop DDoS traffic by its content.

Read definition

Geo-Blocking

Geo-blocking is a control that drops traffic by source country, shrinking the attack surface when an application serves only certain regions.

Read definition

IP Reputation

IP reputation is an L7 control that scores source addresses from threat-intel feeds, blocking or challenging traffic from hosts with a history of abuse.

Read definition

JA3 / JA4 Fingerprinting

JA3 and JA4 are TLS fingerprinting methods that hash ClientHello features into a string identifying client software, used to detect and filter bot traffic.

Read definition

Mitigation Cutover

Mitigation cutover is the switch from normal routing to scrubbing when an attack is detected; the cutover delay sets how long the origin stays exposed.

Read definition

Null Routing (Blackholing)

Null routing (blackholing) is a control that drops all traffic to a targeted IP via a null interface, sacrificing that host to save the rest.

Read definition

Rate Limiting

Rate limiting caps how many requests a source can make per time window, a primary L7 control whose thresholds DDoS testing validates under load.

Read definition

Reverse Proxy

A reverse proxy is a control that fronts origin servers, terminating connections and filtering DDoS traffic before it reaches them.

Read definition

RTBH (Remotely Triggered Black Hole)

RTBH (remotely triggered black hole) uses BGP to null-route all traffic to a targeted IP at the edge, dropping that destination to protect the network.

Read definition

Scrubbing Center

A scrubbing center is upstream infrastructure that filters DDoS traffic out of the flow before it reaches the origin, forwarding only clean traffic onward.

Read definition

Sinkholing

Sinkholing is a control that reroutes attack traffic to a sinkhole for capture and analysis, unlike a black hole, which silently discards it at the edge.

Read definition

SYN Cookies

SYN cookies are a kernel defense against SYN floods that encode connection state into the SYN-ACK sequence number instead of allocating SYN backlog state.

Read definition

Tarpit

A tarpit is a defensive control that deliberately stalls suspicious connections, holding attacker sockets open to slow floods and exhaustion attacks.

Read definition

TCP Accept Queue

The TCP accept queue holds established connections awaiting accept(); a flood that fills it drops completed handshakes even when the SYN backlog is tuned.

Read definition

TCP SYN Backlog

The TCP SYN backlog is the kernel queue holding half-open connections; a SYN flood fills it so legitimate handshakes fail until it is tuned.

Read definition

uRPF (Unicast Reverse Path Forwarding)

uRPF (unicast reverse path forwarding) is an anti-spoofing control that drops packets whose source IP fails a reverse-route check at the network edge.

Read definition

WAF (Web Application Firewall)

A WAF (web application firewall) is an L7 control that inspects HTTP requests and blocks malicious patterns, filtering application-layer DDoS floods.

Read definition

Metrics & Concepts

Amplification Factor

An amplification factor is the ratio of a reflected response to the spoofed request that triggered it, measuring how much a vector multiplies bandwidth.

Read definition

Attack Surface

An attack surface is the full set of exposed endpoints, IPs, ports, and services an attacker can reach, the inventory a DDoS test maps before load.

Read definition

Autoscaler Exposure

Autoscaler exposure is the risk that an L7 flood is read as real demand and scaled into, turning an attack into a cloud bill instead of an outage.

Read definition

Availability

Availability is the share of time a service responds correctly to legitimate users, the metric a DDoS attack is built to drive down.

Read definition

Baseline Traffic

Baseline traffic is a service's normal measured traffic profile, the reference an anomaly-based mitigation compares against to flag a DDoS surge.

Read definition

Bits Per Second (BPS)

Bits per second (BPS) is the rate of data crossing a link, the unit that measures volumetric DDoS attacks built to saturate the network pipe.

Read definition

Blast Radius

A blast radius is how far an attack or test spreads beyond its target, through shared dependencies, tenants, or upstream links into other systems.

Read definition

DDoS Resilience

DDoS resilience is how well a system keeps serving legitimate traffic under attack and how fast it recovers, an emergent property of the whole stack.

Read definition

False-Negative Rate

A false-negative rate is the fraction of attack traffic a mitigation control fails to block, the leakage that reaches the origin past the filter.

Read definition

False-Positive Rate

A false-positive rate is the fraction of legitimate traffic a mitigation control wrongly blocks while filtering an attack, the cost of tighter thresholds.

Read definition

Goodput

Goodput is the share of throughput that delivers useful legitimate traffic, the number that stays meaningful when an attack inflates raw bandwidth.

Read definition

Layer of First Failure

The layer of first failure is the tier that breaks first as attack load rises (link, conntrack, LB, TLS, app, or database), setting the stack ceiling.

Read definition

Mean Time to Detect (MTTD)

Mean time to detect (MTTD) is the average time from the first attack packet to detection recognizing it, the front half of total time-to-mitigation.

Read definition

Multi-Vector Attack

A multi-vector attack combines volumetric, protocol, and application-layer floods at once, hitting different tiers so a single-vector defense is bypassed.

Read definition

Origin IP Exposure

Origin IP exposure is the risk that a server's real IP is discoverable, letting attackers flood it directly and bypass the CDN or scrubbing layer.

Read definition

Packets Per Second (PPS)

Packets per second (PPS) is the rate of packets a device processes, the unit measuring protocol attacks that exhaust hardware regardless of bandwidth.

Read definition

Requests Per Second (RPS)

Requests per second (RPS) is the rate of HTTP requests an application receives, the unit that measures application-layer floods at the L7 tier.

Read definition

Throughput

Throughput is the volume of traffic a system processes per unit time, the capacity a volumetric DDoS attack tries to push past its ceiling.

Read definition

Time-to-Mitigation (TTM)

Time-to-mitigation is the elapsed time from the first attack packet to full scrubbing engaging; the whole interval is when the origin stays exposed.

Read definition

Time-to-Recovery (TTR)

Time-to-recovery is the time from scrubbing engaging to the service returning to its normal baseline: error rates, latency, and pools all restored.

Read definition

Infrastructure & Botnets

Anycast

Anycast announces one IP from many locations so traffic routes to the nearest node, letting DDoS mitigation spread attack load across the edge network.

Read definition

Booter / Stresser

A booter or stresser is a rented DDoS-for-hire service that sells attack traffic on demand, lowering the skill needed to launch a flood.

Read definition

Botnet

A botnet is a network of malware-infected devices an operator controls remotely to flood a target with coordinated traffic from many sources.

Read definition

Command-and-Control (C2)

Command-and-control (C2) is the channel an operator uses to direct a botnet, issuing the target, vector, and timing for a coordinated DDoS attack.

Read definition

IoT Botnet

An IoT botnet is a botnet built from compromised cameras, routers, and other devices, valued for their numbers and always-on connections.

Read definition

IP Spoofing

IP spoofing is forging the source address of packets so a flood appears to come from elsewhere, enabling reflection and evading per-IP blocks.

Read definition

LOIC (Low Orbit Ion Cannon)

LOIC (Low Orbit Ion Cannon) is an open-source tool that floods a target with TCP, UDP, or HTTP requests, used in volunteer DDoS campaigns.

Read definition

Mirai

Mirai is a botnet malware family that infects IoT devices with default credentials, building the fleets behind several record-breaking DDoS attacks.

Read definition

Open Resolver

An open resolver is a misconfigured DNS server that answers any client, abused as a reflector to amplify spoofed queries into a flood.

Read definition

Reflector

A reflector is a third-party server tricked by a spoofed request into sending its reply to the victim, the building block of amplification attacks.

Read definition

Residential Proxy DDoS

Residential proxy DDoS routes attack traffic through real home IPs, so requests blend with legitimate users and defeat IP-reputation filtering.

Read definition