Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does it necessarily protect system from DoS? If not why?

share|improve this question
    
when I am saying overloading, it refers to the natural tendency of systems when they they receive excess information than they are designed, need not be malicious. Overloading can be due to normal operation cycle. –  Vineet Menon Nov 28 '11 at 9:58
add comment

3 Answers

up vote 7 down vote accepted

The difference is intent.

In the normal overload case, your server has perhaps become very popular and is receiving a huge number of legit requests. (E.g. front page of digg/slashdot.)

In a (D)DoS, the attacker is intentionally trying to overload your server. So the attacker would design the attack in a way that would defeat certain mitigation strategies -- especially taking advantage of the application(s) running on the server in order to consume either excess bandwidth, CPU, etc.

A lot would depend on your application, but as a simple example: A mitigation strategy designed to withstand simply "being slashdotted", say by serving a static copy of your front page, could be easily defeated by generating tons of requests for deep pages, or for your search functionality, or for a large file, or by hitting your CAPTCHA image generator particularly hard.

share|improve this answer
add comment

A server overload is one type of DoS, but DoS can mean any type of denial of service, whether it its CPU, network, disk or other service.

Mitigation is a good idea, but the problem with DDoS is that an attacker can use thousands of devices to attack you, which means your mitigation strategy needs to be very robust, not only dealing with load but deflection techniques.

share|improve this answer
add comment

Denial of Service is a broad term, describing attacks that "make a computer resource unavailable to its intended users" (Wikipedia). Overloading a server is a form of DoS, but there are many other forms. You might be able to achieve the same goal by using up the server's maximum number of possible concurrent connections, not overloading the server, but using up a resource. Or by abusing a memory corruption bug Wikipedia that makes the server software crash.

So, by protecting your server against overload, you protect it against one form of DoS.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.