In flood scripts, the script sends UDP packets to "ip.address:random.port" Why It doesn't use only the IP? Is port necessary?
The source and destination ports are part of the UDP packet structure, you cannot send a UDP packet without defining a source and a destination port. Note that the ports can really be anything, whether there actually is something listening on the port on the other side is another story. Then again, the IP layer will be processed before deciding what to do with the port data there fore you are using resources on the target system.
If someone is HTTP flooding a website and take it down. Is it because of HTTP server application is too busy to reply the other packets? If not what is the reason?
Pretty much. If you are HTTP flooding the webserver, then you are counting on the fact that it takes some time to process the HTTP request. And when the server spends almost 100% of its time processing your requests, it will not have processing power to server other requests.
Note that this is hardly true for most websites. Webservers today have several mechanisms to prevent extraneous requests from a single IP, or even very similar requests from different IPs (first D in DDoS). Moreover, there almost certainly be caching on a reverse proxy, which will reduce processing time a lot. You will need a reasonable number of IPs and distinct requests for a DDoS to have a chance to succeed.
Some people told me when I'll target a home router it'd be better if I choose UDP flood rather than SYN or ICMP flood as method. Is it true? If it's true why?
I can only guess on that statement. Although I'd argue that it may be true for home routers, let's try to reason about it:
Mot home routers have good defenses against SYN flooding, and ICMP flooding. The former often blacklists IPs that send several SYN packets without completing the handshake, the later simply stops processing (almost) any ICMP if the router seem overhelmed by it. UDP defenses are slightly harder to make because home routers are often configured to forward DNS queries without asking questions (although that is definitely not the case with industry routers).
UDP is also a lot faster to send from the attacker's side. It is a smaller packet for an attacker to send whilst it steals almost the same number of resources on the defender side. In today's routers what you can expect to achieve is for the attacker to expend resources stripping the IP headers and parsing the layer 3 packet, not much more.
We are not in times where routers would get a SYN packet, reply and wait for an ACK whilst holding the memory (and ending out of memory quite quickly). That attack vector is pretty much dead. That was a reason for which SYN floods were effective, but this vector has been rectified pretty much everywhere.
