I was wondering, to make a DOS attack you need to send something to the target you are DOS-ing. And to send something you need to use some protocol. My question is, are all protocols the same speed? And what are the protocols that DOS programms usually use? My guess the UDP because I saw online it was fatser, but I am not sure.
Bonus question: If a target is using a TCP socket to listen to a connection, and I make a connection using UDP, what will happen? Will I be able to connect or not?
In principle a DDOS attack can send completely legitimate requests and thus overload the server. For example, just use a botnet to visit some persons blog and the server will potentially collapse under the load. There is no real way to protect against this because every request looks like a real request.
However, the often more interesting case is to intentionally violate the protocol on some level to boost the efficiency of an attack. For example opening a lot of TCP connections to a server but never sending anything is very cheap for a client but the server might run out of connections (in whichever sense) because he is waiting for them to time out. These kinds of problems can often be mitigated using appropriate safeguards in code and configuration settings.
So to answer your question: (D)DOS attacks can be carried out with any applicable protocol and often become more powerful by intentionally violating parts of the protocol.
A answer has been accepted here - and it does make some valid points, but did not mention reflected amplification attacks; with tcp only small amounts of data are exchanged (and must be exchanged between both the attacker and victim) before processing, memory and io resources can be consumed. A slowloris type attack as described by Elias exploits a constrained number of connection resources. However there are a number of differences with udp.
Firstly the request from the client to do something can be in the first packet sent by the client.
A consequence of this is that the attacker can forge the 'from' address on the packet - making it difficult to detect an attck, nevermind block it.
There are some udp protocols where a single small request can generate a much larger response - such behaviour was present in the DNS and NTP protocols. This is exploited in an amplification attack - the attacker sends a request to a vulnerable third party server with the 'from' address of the victim. The third party sends out several packets to the victim. Scaling this up to multiple third parties means that an attacker need only use a little bandwidth to fill up a fat network conection at the victim.
I don't know where you read that udp was "faster". Its performance characteristics are very different from tcp (that is part of the reason that they exist as different protocols) but the speed of an ip connection is not simply a question of the bandwidth on the network hops between client and server. Attempting to send large volumes of udp packets across the internet and you will likely end up DOSing your uplink router.
