This lesson introduces denial-of-service attacks, explains how they affect availability, and distinguishes a DoS attack from a distributed denial-of-service attack.
A denial-of-service (DoS) attack is an attempt to make a machine, network, or service unavailable to its intended users. The attacker disrupts a network-connected host temporarily or, in some cases, indefinitely. This targets availability, one of the central goals of information security.
All flashcards
Availability
The ability of intended users to access a system or service when needed.
Botnet
A group of compromised devices that can be coordinated to perform actions such as sending attack traffic.
Application-layer attack
An attack targeting particular application functions, often through requests that consume substantial processing resources.
DDoS attack
A denial-of-service attack that directs traffic at a target from multiple systems or sources.
Blackhole routing
Routing traffic to a null route, preventing it from reaching the destination.
Quiz questions
How does a SYN flood consume a server's connection capacity?Answer: It sends many TCP connection requests without completing the handshake, leaving half-open connections.
What makes a denial-of-service attack an amplified attack?Answer: A relatively small request causes a much larger response to be sent to the victim.
What is the main purpose of an upstream traffic-scrubbing center?Answer: To filter malicious traffic before it overwhelms the victim's network connection.
A site slows after a news story sends it many genuine visitors. Which explanation best fits?Answer: Legitimate demand has unintentionally overwhelmed the site's capacity.
What can backscatter analysis help researchers infer?Answer: That spoofed attacks may be occurring, based on replies sent to forged source addresses.