1

I have questions about DDoS attacks.

  1. In flood scripts, the script sends UDP packets to "ip.address:random.port"

    Why It doesn't use only the IP? Is port necessary?

  2. If someone is HTTP flooding a website and make it down.

    Is it because of HTTP server application is too busy to reply to the other packets? If not what is the reason?

  3. Some people told me that if I would target a home router it would be better if I choosen UDP flood rather than SYN or ICMP flood as method.

    Is it true? If it is true why?

4

1- In flood scripts, the script sends UDP packets to "ip.address:random.port"

Why It doesn't use only the IP ? Is port necessary ?

UDP is a multiplexed protocol: it allows for multiple connections between two hosts.

Thus a UDP connection is defined by the tuple (src address, src port, dst address, dst port).

2- If someone is HTTP flooding a website and make it down. Is it because of HTTP server application is too busy to reply the other packets ? If not what is the reason ?

It could be that the web server or app is using too many resources, for example if it was asked to perform an expensive operation.

It could be that the target's available bandwidth has been exceeded and packets are being dropped.

Less commonly, it could be that some device between the target and the rest of the world was brought down by the attack.

3- Some people told me when I'll target a home router it'd be better if I choose UDP flood rather than SYN or ICMP flood as method. Is it true ? If it's true why ?

You'll have to ask the person who told you this. If I had to guess I'd say it's because UDP is less constrained by congestion.

  • So if target is replying with an 500 HTTP code and using too many resources, would it be able to reply ICMP packets ? – imafunnypanda Aug 29 '16 at 18:07
  • @imafunnypanda depends on the resource being exhausted. ICMP is handled by the OS, http responses are handled by the web server. If the resource being exhausted is "number of webserver workers" the OS will probably still be able to respond to ICMP. If the resource being exhausted is outgoing bandwidth packets will get dropped and ICMP replies wouldn't get through. – GnP Aug 29 '16 at 18:13
0

In flood scripts, the script sends UDP packets to "ip.address:random.port" Why It doesn't use only the IP? Is port necessary?

The source and destination ports are part of the UDP packet structure, you cannot send a UDP packet without defining a source and a destination port. Note that the ports can really be anything, whether there actually is something listening on the port on the other side is another story. Then again, the IP layer will be processed before deciding what to do with the port data there fore you are using resources on the target system.

If someone is HTTP flooding a website and take it down. Is it because of HTTP server application is too busy to reply the other packets? If not what is the reason?

Pretty much. If you are HTTP flooding the webserver, then you are counting on the fact that it takes some time to process the HTTP request. And when the server spends almost 100% of its time processing your requests, it will not have processing power to server other requests.

Note that this is hardly true for most websites. Webservers today have several mechanisms to prevent extraneous requests from a single IP, or even very similar requests from different IPs (first D in DDoS). Moreover, there almost certainly be caching on a reverse proxy, which will reduce processing time a lot. You will need a reasonable number of IPs and distinct requests for a DDoS to have a chance to succeed.

Some people told me when I'll target a home router it'd be better if I choose UDP flood rather than SYN or ICMP flood as method. Is it true? If it's true why?

I can only guess on that statement. Although I'd argue that it may be true for home routers, let's try to reason about it:

Mot home routers have good defenses against SYN flooding, and ICMP flooding. The former often blacklists IPs that send several SYN packets without completing the handshake, the later simply stops processing (almost) any ICMP if the router seem overhelmed by it. UDP defenses are slightly harder to make because home routers are often configured to forward DNS queries without asking questions (although that is definitely not the case with industry routers).

UDP is also a lot faster to send from the attacker's side. It is a smaller packet for an attacker to send whilst it steals almost the same number of resources on the defender side. In today's routers what you can expect to achieve is for the attacker to expend resources stripping the IP headers and parsing the layer 3 packet, not much more.

We are not in times where routers would get a SYN packet, reply and wait for an ACK whilst holding the memory (and ending out of memory quite quickly). That attack vector is pretty much dead. That was a reason for which SYN floods were effective, but this vector has been rectified pretty much everywhere.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.