Protocol Attacks exploit a specific feature or implementation bug of some protocol installed at the victim in order to consume excess amounts of its resources. This type of attack consumes actual server resources, or those of intermediate communication equipment, such as firewalls and load balancers, and is measured in packets per second (pps). Common protocol attacks include smurf attack, SYN attack, UDP attack, ICMP attack, CGI request attack, authentication server attack, attack using DNS systems, and attack using spoofed address in ping.

RADB is a public registry of network routing information.

Random Sub-domain Attack is a form of DNS attacks. It refers to randomly generated attacks targeting at sub-domain on a legitimate domain. To resolve the domains, a recursive DNS server spawns concurrent queries that inevitably hit the limit, while authoritative DNS servers experience DoS.

Rate Limit is applied to limit exploitation of system and bandwidth resources against baseline statistics.

Reflection Attack involves sending forged requests of some type to a very large number of computers with the source IP address spoofed to that of the targeted victim, hence, floods the target with the computers’ reply. DNS Reflection Attack is a typical example.

RST Flood is a type of DDoS attack that bombards the victim server with fake RST packets that have no connection to any of the sessions stored in the server’s database. This consumes lots of system resources to compare the incoming packets with the current transmissions resulting in loss of productivity and partial unavailability.

R-U-Dead-Yet? (RUDY) attacks target web applications by starvation of available sessions on the web server. Similar to Slowloris, RUDY keeps sessions at halt using never-ending POST transmissions and sending an arbitrarily large content-length header value.

Scrubbing Capacity is the capability to scrub a DDoS attack. It is usually presented in Gbps/Tbps and Mpps/Gpps.

Security Operation Centre is the 24x7 team that protects the customers from DDoS attack.

Server Name Indication is an extension to TLS by which a client indicates which hostname it is attempting to connect to at the start of the handshaking process. This allows a server to present multiple certificates on the same IP address and TCP port number without requiring all these sites to use the same certificate. The desired hostname is not encrypted, so an eavesdropper is still possible to see which site is being requested.

Slowloris exploits the open connections of a web server by sending a partial request without ever completing them. This can fill up the maximum concurrent connection pool quickly that results in denial of service for legitimate requests.

Slow Post Attack sends a legitimate HTTP POST header to a web server which specifies the exact size of the message body. However, the message body is sent at an alarmingly low rate for as low as 1 byte per minute to consume all the server resources that make legitimate connections impossible.

Slow Read Attack sends legitimate application layer requests, but reads response very slowly trying to exhaust the server’s connection pool. It is achieved by advertising a very small number for the TCP Receive Window size and at the same time, emptying the TCP receive buffer slowly resulting in a very low data flow rate.

Smurf is a form of reflection attack as the flooding hosts send Echo Requests to the broadcast addresses of the misconfigured networks, thereby enticing hosts to send Echo Reply packets to the victim.

SNAT stands for secure network address translation or source network address translation.

SNAT Pool is a group of IP addresses that the system can choose from to use for a translation address. Each address in a SNAT pool will implicitly create a SNAT translation if one does not exist.

SNMP Flood is a type of reflection attacks that can generate huge traffic load by eliciting SNMP responses to the spoofed victim IP address. When amplified, SNMP flood can be more dangerous as it is possible to achieve 1000+ amplification factor.

Spider, a.k.a. web crawler, is a bot that automatically traverses the web by downloading documents and following links from page to page.

SSDP Flood is a reflection based DDoS attack that exploits UPnP protocols to send an amplified amount of traffic to a victim host.

SSL Cipher is a set of algorithms that help secure a network connection that uses Transport Layer Security (TLS) or Secure Socket Layer (SSL). This set of algorithms typically contains a key exchange algorithm, bulk encryption algorithm and a message authentication code (MAC) algorithm. The key exchange algorithm is used to exchange a key between two devices. This key is used to encrypt and decrypt the messages being sent between two machines. The bulk encryption algorithm is used to encrypt the data being sent. The MAC algorithm provides data integrity checks to ensure that the data sent does not change in transit. In addition, cipher suites can include signatures and an authentication algorithm to help authenticate the server and or client.

SYN Flood is an attempt to make the system unresponsive to legitimate traffic by sending a succession of SYN requests to the target system to consume enough server resources. The TCP three-way handshake is the foundation of this form of attack. A SYN flood attack works by not responding to the server with the expected ACK code. The malicious client can either simply not send the expected ACK, or by spoofing the source IP address in the SYN, causing the server to send the SYN-ACK to a falsified IP address, which will not send an ACK because it “knows” that it never sent a SYN. The server will wait for the acknowledgement for some time, as simple network congestion could also be the cause of the missing ACK. However, in an attack, the half-open connections created by the malicious client bind resources on the server and may eventually exceed the resources available on the server. At that point, the server cannot connect to any clients, whether legitimate or otherwise. This effectively denies service to legitimate clients. Some systems may also malfunction or crash when other operating system functions are starved of resources in this way.

TCP Flood exploits the TCP three-way handshake protocol that consumes resources of the targeted servers. It can exist in many forms including SYN flood, ACK flood, FIN flood, RST flood, ...

Teardrop Attack involves sending mangled IP fragments with overlapping, oversized payloads to the target machine. This crashes operating system that has a bug in the TCP/IP reassembly coding.

Threat Map shows the most popular geo-locations of real visitors (legitimate requests) and botnets (malicious attacks).

Threshold Values indicate the total volume (in pps or bps) of the traffic whether to be allowed to enter a site or network or not.