22

Does bandwidth alone determine how many packets a router or server can handle before the server is overran and then goes offline?

  • 1
    Usually but not always. Maybe the attacker overloads the CPU and it can't process other packets. Maybe the attacker overloads the disk, so even though the server can understand other requests, it can't access the data that's being requested fast enough. Or if the attacker can find a bug in the server that causes it to crash, that's also a DoS. – immibis Jun 28 '16 at 11:16
  • 8
    Whatever the bottle-neck is will cause problems first. This can be bandwidth, memory, CPU load, routers and switches, etc. – Potaito Jun 28 '16 at 11:31
  • 3
    You tagged this ddos, but the question title is only saying DoS. Be clear. Do you mean a distributed denial-of-service attack, or do you mean any form of denial-of-service attack or error? I suspect you mean specifically a Distributed DoS attack, which is usually accomplished through large numbers of requests sent from multiple devices e.g. from a botnet. – Martin Carney Jun 28 '16 at 22:20
  • There sure seem to be a lot of security.se questions these days worded as if the attack was the goal. 'determine how strong a DoS attack should be?' verses 'determine how effective a DoS attack might be?'. – infixed Jun 29 '16 at 18:05
82

Imagine a post office.

It has an entrance, a counter with a clerk who deals with the customers and their packets. The clerk is a multi-tasking talent with a lot of arms to deal with packets on the counter.

The counter has a certain width, so only a certain number of customers can be processed at the same time.

The clerk has a small address book with addresses of where to send the packets. Some pages are blank, and he can input new addresses.

Behind the counter and the clerk are a certain number of shelves, where the assistant of the clerk puts packets until they can be further processed and sent.

There are now several cases for a DDOS / DOS attack in this metaphor.

Case 1 - SW Bug

One mean customer steps forward, leans over to the clerk and shows the clerk the packet with the address "Vietnam" on it - which triggers the clerks PTSD1. This is something only a few people knew about. The clerk starts sobbing uncontrollably, sits in a corner and is of no further use to the post office. It has to close early, until the owner of the office comes, says some magic words and restarts the office.

The word "Vietnam" in this case stands metaphorically for a bug that the mean customer abuses. Since usually only one packet is needed to freeze the office, this might not count as a DDOS, but certainly a DOS.

Case 2 - Bandwidth

The post office has only one door, through which all the customers and the packets have to squeeze themselves, incoming and outgoing ones alike.

If an attacker wants so abuse this, he might gather a lot of unusually big customers and/or packets to enter the post office all at the same time. Now the doors are too tight and new customers can't enter while other customers can't leave the store. This halts the post office, until the clerk puts down a rule at the entrance: "You must be smaller than this to enter".

Everyone trying to enter the office while being too big won't be allowed to enter the office.

The doors here stand for the bandwidth; the more bandwidth you have the more customers can enter / leave at the same time. Since this is pretty dynamically, it's sometimes hard to find the exact point at which the store has to halt.

Case 3 - CPU Load

Whenever a customer comes to the clerk, he has to greet them, take the packet and process it. Usually he has to check if the address is correct, the packet is not purple (purple packets are not standardized packets and therefore bad!). If the clerk is really paranoid, he has to open the packet, look to make sure that no contraband is inside, test if the packet smells like Anthrax, etc.

So depending on the rules for the post office, the clerk has to check a lot of parameters. If an attacker wants to abuse this, he can gather a lot of people with a lot of small packets. The clerk has to process EVERY packet, which can create a lot of overhead.

Because of this, the customers outside start to pile up, and some even start to curse and leave the line, since they don't have all the time in the world to wait in this line forever.

So CPU load usually has to do with processing in this metaphor.

Case 4 - Memory

The clerk works for quite some time in the post office, so he has memorized several addresses. He also has some addresses written in his address book.

A attacker can abuse this by gathering a lot of people and tell them to write unusual addresses on their packets.

So each time the clerk processes one of those mean customers, he has to write down another addresses into his book. This soon gets filled and now he is in trouble. How should he process new addresses? Kick out old ones? He has no idea and maybe stops his processing altogether.

The address book stands for the memory, which is finite.

Case 5 - Connections

The counter has a mentioned width. Since the clerk is a multi-tasking talent, he can deal with 3000 customers at once, but not more.

The attacker can abuse this fact by gathering a lot of people and tell them to try to rush to the counter. Now there are 5000 people, demanding to get their packet processed, causing a lot of stress for the clerk with his just 3000 arms.

Case 6 - Disks (and other resources)

The clerk has to store the packets into a shelf behind his counter. This is the job of his assistant. Some assistants are faster than others, so sometimes it can happen, that the clerk can deal with 3000 customers at once, while the assistant has to slowly move himself and the packet to the correct part of the shelf.

So while the clerk certainly is fast enough, the poor assistant is not. The assistant in this case can be the server disks or other components.

Conclusion:

DDOS / DOS attacks can use a lot of different methods and parameters to stop or slow the service of a server / server-cluster. Therefore it depends on a lot of factors: Which software you use, how much bandwidth you have, the CPU, memory etc.


[1] PTSD is no joke, but it fits this metaphor nicely. I apologize for using it in a jokingly fashion.

  • 5
    Your "Vietnam" packet comes in multiple flavors, but its usually not just 1 packet. Usually it has to do with packet fragmentation in which the mean customer would step forward with a packet that says ... partial packet flip over for more on both sides ... and the clerk keeps buffering all of the 'partial' packets until it gets a headache. Another method is to have a whole bunch of mean customers each with 1 packet saying ... partial packet wait for more info with no intention of providing more info ... in which case the clerk runs out of (sockets) hands. – CaffeineAddiction Jun 28 '16 at 14:03
  • 3
    Also it is worth noting that the clerk is not always the chink in the armor ... in terms of killing CPU or Disk Space it is usualy more effective to slam a computationally expensive server api ... like one that is known to do a massive SQL join or a type of password hashing. For example it is easy to send random strings to the 'update password' api on a website ... but the new password has to be hashed and then stored for each request ... this is a case where several small computers could easily overpower a large server. – CaffeineAddiction Jun 28 '16 at 14:10
  • 20
    You forgot one: Slowris. That old lady that takes 30 minutes to take the money off to pay, and then the clerk notices that the money isn't enough. And keeps receiving the money, penny by penny. Now, fill the counter with 3000 old ladies. Or am I getting this wrong? – Ismael Miguel Jun 28 '16 at 18:27
  • 5
    +1 for 'test if the packet smells like Anthrax' – abligh Jun 29 '16 at 10:13
  • 2
    @IsmaelMiguel You've got it right, although it's called a "Slowloris" attack: en.wikipedia.org/wiki/Slowloris_(computer_security) – SnakeDoc Jun 29 '16 at 15:34
5

First you have to be clear that there are different kinds of denial of service attacks. Some of them don't require a lot of resources, they use vulnerabilities in software to block the server client communication. Brute-force DOS attacks are most of the time DDOS attacks.

To answer your question: No, it's not only the bandwith that can cause DOS attacks. Routers or Webservers have configs that limit the amount of connections (apache2 default 10.000). As soon as they are filled up and another client wants to connect, it will get refused (dos).

  • So if the default is 10,000 what would big companies implement to counter this issue? Just another server to take on the load? – 99Con Jun 28 '16 at 12:07
  • they would eighter change the config to e.g. 1.000.000 or just use another software – licklake Jun 28 '16 at 12:28
  • @WilliamWallace they'd use a load balancer to split the traffic between servers. – hd. Jun 29 '16 at 8:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.