What is DDoS? Is It Related to Distributed Denial-of-Service?

What is DDoS? Well, if you're new to the Internet or just haven't heard of it, then you probably have an image in your mind of how attackers go about on their campaigns. DDoS is also referred to as a DoS attack - a form of cyber attack whereby an attacker deliberately attempts to deliberately disrupt the normal operation of a victim network or server. Victims of such an attack are often unable to access network resources or systems to make even legitimate requests because of too much unnecessary Internet traffic draining the system s performance.

There are a number of ways an attacker may choose to implement the attack. It could be a Distributed Denial-of-Service (DDoS) or an overload attack. In a DDoS attack, the attacker overloads a system with Internet traffic in order to bring it to a standstill or to stop communication. This is a massive attack and may even involve multiple attackers or several systems. For this reason, it's always best to seek an on-premise DDoS protection instead of forgoing on-demand or stand-by protection.

There are several best protection methods for both an attacker and an innocent victim. The most basic type of protection is physical or addressed physical security. With this type of on-demand or stand-by protection, an Internet Service Provider (ISP) can use their own equipment and network to block or interfere with the attack. These systems work by requesting that all data packets are delivered within a specific, pre-determined range. Most common applications for addressing the attack include firewalls and security gateways.

Another form of on-premise protection is through load balancers. With this type of application layer attacks prevention method, an ISP can assign IP address blocks to different servers on their network to avoid interfering with each other. Servers that are not part of the Internet service provider's internal networks can still be affected. These load balancers can be manually disabled to allow data packets to go through. However, in a dynamic environment, when multiple applications and server resources are making up a dynamic website, an IP address may be unassigned every so often, resulting in the application layer attacks returning.

Stand-by or failover protection is often used as a last resort for IT infrastructure investments. For businesses that don't have servers that are instantly responsive to DDoS attacks, this method of defense may prove to be ineffective and expensive. A standby or failover solution must continuously monitor for the attacks and then restart or reboot servers if needed to resume normal operation.

Bandwidth caps are commonly placed on Internet connections to prevent excessive traffic from going to targeted servers. This is not effective against a DDoS attack, because if the attack is successful the attackers may use the extra bandwidth to send more attacks. Bandwidth caps do not stop attacks; they prevent the overload of traffic that is caused by long-travelling Internet connections. If the connection is shut down during a DDoS attack, the Internet traffic still goes to the servers. The attacker uses the idle time to send more attacks and to recover from previous attacks.

An attacker might also use a bot or a program that sends repeated messages to a server asking it to execute a particular piece of code. When a server responds to the request, the user's computer accesses the server without authorization. The attacker sends commands through the Internet using a signaling protocol that allows him to communicate with the server using what is known as an indirect protocol. This protocol is usually misrecognized by legitimate network users, who think their system is communicating with a real server.

A DDoS is often used by an attacker in order to overload a server with traffic in a very short period of time, causing the server to respond in kind. As soon as the server realizes that the attacker has done so, it will halt communication with that server and won't deliver any more traffic until the attacker stops making noise. If the attacker cannot be stopped, he will move on to another server. In a traditional attack, this would not have happened, but in a DDoS the attacker has much more sophisticated tools at his disposal.