Volumetric DDoS attacks are designed to overwhelm internal network capacity and even centralized DDoS mitigation scrubbing facilities with significantly high volumes of malicious traffic. These DDoS attacks attempt to consume the bandwidth either within the target network/service, or between the target network/service and the rest of the Internet..

What Are the Different Types of Volumetric DDoS Attacks?

Volumetric DDoS attacks are typically launched against a specific target, usually critical Service Provider (SP) services or enterprise customers. Highly skilled attackers tend to combine volumetric DDoS attacks with application layer attacks to hide the more focused application level attacks which do the real damage. These types of DDoS attacks take advantage of vulnerable services like memcached, NTP, DNS and SSDP, launching spoofed queries which will flood the destination with large reply packets, filling up links, and many cases, resulting in the target network infrastructure collapsing.

Common volumetric attacks might include:

• ICMP Flood
• IP/ICMP Fragmentation
• IPSec Flood
• UDP Flood
• Reflection Amplification Attacks

State-exhaustion DDoS attacks are primarily focused on taking down services or underlying network infrastructure which is responsible for delivering content to the end users. This might involve an attacker targeting DNS name servers with invalid name queries, thus resulting in increased load on the DNS infrastructure itself, disrupting service as users will no longer be able to connect to the services as the DNS name cannot be resolved to IP addresses. This DDoS attack vector was used in the DYN attack in 2016 which resulted in major web sites like Amazon, Twitter, Github and others becoming unavailable. The attacker might also target Transport Layer Security (TLS) endpoints, thereby resulting in legitimate users being unable to connect to the services. As the name suggests, these DDoS attacks target stateful devices such as Next Gen Firewalls with the intention of filling TCP State Tables with bogus connections. These DDoS attacks are typically employed by determined attackers who monitor and adjust their attacks for maximum impact.

Such DDoS attacks are usually low-to-mid volume since they have to conform to the protocol the application itself is using, which often involves protocol handshakes and protocol/application compliance. This means that these attacks will primarily be launched using discrete intelligent clients, usually IoT devices, and cannot be spoofed.

What Are the Different Types of State-Exhaustion DDoS Attacks?

State-exhaustion DDoS attacks typically target the edge load balancers, firewalls, and stateful traffic inspection services of publicly-exposed services by stressing the scale of the Transmission Control Protocol (TCP) state machine of these devices. These DDoS attacks can easily overwhelm even large-scale enterprise services, but present as much lower overall bandwidth attacks (typically less than 10-20 gigabits per second), so they are not normally considered a direct threat to the network provider’s infrastructure. State-exhaustion DDoS attacks cannot be mitigated in stateless edge router infrastructures.

Common state-exhaustion attacks might include:

• SYN Flood
• SSL/TLS Exhaustion
• DNS Query/NXDOMAIN Flooding