Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

How is it possible to make a DOS attack from a single computer?

Let us assume two computers, one acting as server and the other as client. Both has 100/100 mbit bandwitdh.

How can then the client make a DOS attack on the server if both have the same bandwidth? I mean, why is that technically possible?

share|improve this question
The most basic way: Force the server to make more connections then it can support – Ramhound Mar 6 '12 at 18:50

3 Answers

up vote 3 down vote

Bandwidth is just one resource that can be targeted. If the server runs some expensive server-side scripts, it is quite possible to exhaust its CPU or RAM resources without putting much strain on the network.

share|improve this answer
Let`s say the server just have a HTTP server running and the only file that is downloadable from the server is a 1 GB file. If the client opens 30 connections to the HTTP server and downloads the file 30 times in parallell, then the bandwidth should be as much affected for the client as it is for the server. In such a case, i guess it is only the bandwidth that is affected? – Rox Mar 4 '12 at 10:24
1  
Roughly, yes, that's how it works. Usually, DoS attacks are launched from botnets though, so each client only fires a fraction of the total load: instead of one client opening 300 connections, you have 300 clients opening one connection each. – tdammers Mar 4 '12 at 12:04
Technically...If there are multiple clients then its not a DoS attack its a DDOS attack. – Ramhound Mar 6 '12 at 18:51
up vote 3 down vote

Purely limiting this answer to bandwidth exhaustion, there are still a few possibilities not covered by the existing answers.

You are unlikely to be the only client using the server. If the server is already receiving requests and sending responses totalling 10Mb/s, the DoS client will only need to use 90Mb/s to saturate the connection.

You don't have to completely saturate a connection to cause a DoS. As soon as you go over that 90Mb/s, real clients will have trouble getting through and the requests will start queueing up. In real terms, this will cause very slow page loads. Unless the incoming request rate slows down, this will eventually be a complete DoS.

There are also techniques for amplifying the bandwidth used by the server.

A single HTTP request usually requires the server to make several requests to other resources to satisfy the original request. These could be internal such as database queries, memcached, sphinx, NFS, etc. or external such as DNS requests, API calls and proxied requests. If the 100Mb/s restriction is on the server's connected switch, the client will not need its full 100Mb/s to DoS the server. If the 100Mb/s restriction is only on the uplink, the server could still be using more bandwidth than the client due to those DNS requests, API calls and proxied requests.

However, you didn't specify that the server is a web server.

Since the source of a UDP packet can be spoofed easily the client can make UDP requests of the server such that the response is much larger than the request and is sent somewhere other than the client. DNS responses are usually larger than requests and, if done correctly, can be 30x larger. In the case of a streaming video server, a single request to stream a 10MB video uses a few Kb/s from the client and will max out the 100Mb/s connection at the server for 8/10ths of a second. Two such requests per second would DoS the server ( and some random guy who owns the spoofed IP ).

share|improve this answer
Good answer! I was thinking about the UDP packets. If you send very big UDP packets (much larger than the MTU) to a random port on the server (assume the port is closed and all packets are ignored), the bandwidth of the server should still be affected, even if the server blocks UDP packets, since the blocking of UDP packets are made at the network layer if no hardware device is blocking the UDPs (I suppose it´s the network layer where UDP packets are stopped if the destination port is closed?). – Rox Mar 4 '12 at 14:14
Continuation of the above post: So, is it technically possible to affect the bandwidth by just sending large UDP packets to a destination no matter if the destination port is closed or open? – Rox Mar 4 '12 at 14:14
Rox, essentially yes. If the filtering is being done on the iptables it would be filtering by the kernel. In practice even with a firewall device, it is possible to overload the FW with UDP traffic and exhausting all the available resources if the bandwidth is large enough. – neil Mar 4 '12 at 17:48
up vote 2 down vote

The DoS comes, as you say from the fact they have the same bandwidth, so if you can saturate the bandwidth of the server, it will become a lot harder for other people to connect to the server.

If you start downloading 30 GB files, and the server doesn't throttle, cap or shape its bandwidth, you can "DoS" it for as long as it takes to download those 30 packages.

There are other ways like:

  • TCP SYN flood
  • ICMP flood

Also Sergey Sheykan made a way to DoS a server with slow TCP reads, read the article here.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.