Anatomy of a DDoS

What is a DDoS attack?

A DDoS attack is a special type of offense that a malicious user throws against you. It generates an incredible amount of traffic towards your servers so that they can no longer accept genuine traffic, rendering your service unavailable.

What is a DoS attack?

The simplest form of a DDoS attack is a DoS, otherwise known as, you guessed it, Denial of Service. This attack is, fundamentally, a DDoS without being distributed, meaning that the source of the attack is fixed, a machine that repeatedly sends traffic to a network, attempting to bring it down.

Blocking a DoS attack is usually a simple task, as one could simply create a firewall rule banning the IP address that generates the disproportionate amount of traffic. DoS attacks are generally easier to mitigate, therefore we’ll simply refer to DDoS throughout this chapter, as we believe they are a much bigger threat to our web applications than DoS. A large portion of the mechanics behind them are exactly the same, with the only difference being the originator(s) of the attack. A DoS is a machine attempting to bring down a server through network requests, a DDoS is multiple machines performing a DoS.