1

Although I know how a user could mitigate Dos attacks and detect their presence e.g. checking packets received and sent, comparing current CPU usage to normal, comparing network usage to normal etc.

Other than comparing the speed the target system is now receiving packets, how else can perpetrators of denial of service attacks, determine the impact their attack has had?

1

Recent attacks seem to have been aiming to get media coverage of outages - see things like the December 2014 Lizard Squad attacks on Xbox Live and PSN, or the November 2015 Armada Collective attacks. Throw enough traffic at a high profile target (social network, gaming service, news service) and sooner or later you'll get media reports about it.

Beyond that, there isn't much you can do - by definition, a successful attack will result in the service under attack being unreachable. If you can reach it, you need more traffic, or to re-route your traffic, or to change the type of your traffic - if a server can handle huge volumes of HTTP traffic, can it handle the same volume of HTTPS traffic? It's not massively more difficult to serve, but caching might be set up incorrectly, resulting in higher load on servers. If there is a firewall dropping connections after a relatively low number of attempts from a given IP address, you need more IP addresses, to keep the number of connection attempts from each down. Is the system handling everything without any problems? Try doubling the number of connections.

The other thing to be aware of is that the attackers are not necessarily the people running the systems that are doing the attacking. This might seem counter-intuitive, but there are various DDoS-as-a-service type offerings around. An attacker can pay for a certain level of traffic to hit a given IP address or domain name, at a given time, and, from their point of view, it just happens. In that case, they might get some basic stats (how many connections are being dropped, total connections, total bandwidth required to handle everything being thrown at the system), but will have limited ability to affect these - they can pay for more traffic, but probably not control where it comes from. Some of these services tend to be open to bribery too - can you pay more than whoever you're attacking? If not, they might just pay off the service - the service still gets the money.

1

The most easiest way to determine the impact of the DOS/DDOS attack would be to try and access one of the legitimate services hosted on the server under attack, if the server does not respond to the service request then it would be due the DOS/DDOS.

But the above test can be done only for services that we know are publicly hosted on the target.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.