Reference

DDoS Definitions

Precise, engineer-grade definitions of the attack vectors, defensive controls, and methodology terms that come up in DDoS testing.

Attack Vectors

ACK Flood

An ACK flood is an L4 attack that sends TCP ACK packets matching no open connection, forcing stateful firewalls and conntrack tables to waste lookups.

Read definition

Application-Layer Attack

An application-layer attack is an L7 DDoS class of valid but costly requests that exhaust CPU and backends at low bandwidth, evading volumetric filters.

Read definition

Carpet Bombing

A carpet bombing attack spreads a volumetric flood across many IPs in a subnet at once, staying under per-IP thresholds to evade detection.

Read definition

CLDAP Amplification

A CLDAP amplification attack spoofs the victim IP to exposed LDAP servers on UDP 389, which reply 50x to 70x larger to build a volumetric flood.

Read definition

DNS Amplification

A DNS amplification attack spoofs the victim IP to open resolvers, which return far larger responses, building a volumetric flood of hundreds of Gbps.

Read definition

DNS Water Torture

A DNS water torture attack floods resolvers with random nonexistent subdomains, forcing every query down to the victim's authoritative DNS servers.

Read definition

HTTP Flood

An HTTP flood is an L7 attack that sends high volumes of valid-looking GET or POST requests, exhausting CPU, worker threads, and the database tier.

Read definition

IP Fragmentation Attack

An IP fragmentation attack floods a target with incomplete or overlapping IP fragments, exhausting the kernel reassembly buffer at low packet rates.

Read definition

Memcached Amplification

A memcached amplification attack reflects a small spoofed UDP request off open port 11211 servers into a flood, the highest known amplification factor.

Read definition

NTP Amplification

An NTP amplification attack abuses the monlist command on open NTP servers to reflect a tiny spoofed query into a response hundreds of times larger.

Read definition

Ping of Death

A ping of death is an L3 attack sending an oversized ICMP packet that overflows the reassembly buffer, crashing or hanging a vulnerable host.

Read definition

Protocol Attack

A protocol attack is a DDoS class that exhausts stateful tables in firewalls and kernels with packet floods, measured in packets per second.

Read definition

Pulse Wave Attack

A pulse wave attack delivers short repeated bursts of high-volume traffic, exploiting the reaction window before scrubbing fully engages.

Read definition

RST Flood

An RST flood is an L4 attack that sends spoofed TCP RST packets, forcing the target and inline stateful devices to burn CPU on connection-table lookups.

Read definition

RUDY Attack (R-U-Dead-Yet)

A RUDY (R-U-Dead-Yet) attack is an L7 slow-POST attack that dribbles a large request body byte by byte, tying up worker threads at low bandwidth.

Read definition

Slowloris

Slowloris is an L7 slow attack that holds many connections open with partial HTTP requests sent slowly, exhausting the connection pool at low bandwidth.

Read definition

Smurf Attack

A smurf attack is an L3 reflection vector that spoofs the victim IP in ICMP echoes to a broadcast address, so every host floods the victim at once.

Read definition

SYN Flood

A SYN flood is an L4 attack that sends TCP SYN packets without completing the handshake, exhausting the SYN backlog so legitimate connections fail.

Read definition

TCP Connection Flood

A TCP connection flood opens many full TCP connections and holds them idle, exhausting socket and conntrack tables so new connections fail.

Read definition

TLS Renegotiation Attack

A TLS renegotiation attack forces repeated handshakes to exhaust server CPU on asymmetric crypto, saturating compute at very low bandwidth.

Read definition

UDP Reflection / Amplification

A UDP reflection/amplification attack spoofs the victim IP to misconfigured servers that reply with far larger responses, multiplying attack bandwidth.

Read definition

Volumetric Attack

A volumetric attack is a DDoS class that saturates the network link in bits per second, dropping legitimate packets before they reach the origin.

Read definition

Defenses & Controls

ACL (Access Control List)

An ACL (access control list) is a network control that permits or denies packets by IP, port, or protocol, dropping bad traffic at the router or firewall.

Read definition

Always-On Mitigation

Always-on mitigation routes all traffic through scrubbing at all times, removing the detection-and-cutover delay that on-demand DDoS protection incurs.

Read definition

BCP 38 (Ingress Filtering)

BCP 38 is an ingress-filtering standard that drops packets with spoofed source IPs at the edge, preventing reflection and amplification attacks.

Read definition

BGP Flowspec

BGP Flowspec is a control that distributes packet-filter rules across routers via BGP, dropping DDoS flows by port, protocol, or size at the edge.

Read definition

Block vs Count Mode

Block-vs-count mode is the WAF setting deciding whether a matched rule drops a request or only logs it; a rule left in count mode is absent under attack.

Read definition

Bot Management

Bot management is an L7 control that classifies clients by fingerprint and behavior, filtering automated DDoS traffic while passing real users.

Read definition

CDN (Content Delivery Network)

A CDN (content delivery network) is a distributed edge that caches content and absorbs volumetric DDoS load across many points of presence.

Read definition

Challenge-Response

A challenge-response control interrupts suspect clients with a test (JS, CAPTCHA, or proof-of-work) that bots fail, filtering automated DDoS traffic.

Read definition

Clean Pipe

A clean pipe is a managed DDoS service that routes traffic through a scrubbing provider, returning only filtered clean traffic to the origin link.

Read definition

Conntrack Exhaustion

Conntrack exhaustion is a failure where a flood fills the kernel connection-tracking table, so stateful firewalls drop new legitimate flows.

Read definition

Geo-Blocking

Geo-blocking is a control that drops traffic by source country, shrinking the attack surface when an application serves only certain regions.

Read definition

IP Reputation

IP reputation is an L7 control that scores source addresses from threat-intel feeds, blocking or challenging traffic from hosts with a history of abuse.

Read definition

JA3 / JA4 Fingerprinting

JA3 and JA4 are TLS fingerprinting methods that hash ClientHello features into a string identifying client software, used to detect and filter bot traffic.

Read definition

Mitigation Cutover

Mitigation cutover is the switch from normal routing to scrubbing when an attack is detected; the cutover delay sets how long the origin stays exposed.

Read definition

Rate Limiting

Rate limiting caps how many requests a source can make per time window, a primary L7 control whose thresholds DDoS testing validates under load.

Read definition

RTBH (Remotely Triggered Black Hole)

RTBH (remotely triggered black hole) uses BGP to null-route all traffic to a targeted IP at the edge, dropping that destination to protect the network.

Read definition

Scrubbing Center

A scrubbing center is upstream infrastructure that filters DDoS traffic out of the flow before it reaches the origin, forwarding only clean traffic onward.

Read definition

Sinkholing

Sinkholing is a control that reroutes attack traffic to a sinkhole for capture and analysis, unlike a black hole, which silently discards it at the edge.

Read definition

SYN Cookies

SYN cookies are a kernel defense against SYN floods that encode connection state into the SYN-ACK sequence number instead of allocating SYN backlog state.

Read definition

Tarpit

A tarpit is a defensive control that deliberately stalls suspicious connections, holding attacker sockets open to slow floods and exhaustion attacks.

Read definition

TCP Accept Queue

The TCP accept queue holds established connections awaiting accept(); a flood that fills it drops completed handshakes even when the SYN backlog is tuned.

Read definition

TCP SYN Backlog

The TCP SYN backlog is the kernel queue holding half-open connections; a SYN flood fills it so legitimate handshakes fail until it is tuned.

Read definition

uRPF (Unicast Reverse Path Forwarding)

uRPF (unicast reverse path forwarding) is an anti-spoofing control that drops packets whose source IP fails a reverse-route check at the network edge.

Read definition

WAF (Web Application Firewall)

A WAF (web application firewall) is an L7 control that inspects HTTP requests and blocks malicious patterns, filtering application-layer DDoS floods.

Read definition

Infrastructure & Botnets

Anycast

Anycast announces one IP from many locations so traffic routes to the nearest node, letting DDoS mitigation spread attack load across the edge network.

Read definition