23

So I get the basic idea of (D)DoS used for flooding, but I don't quite understand how this causes servers to crash or get them to slow down due to CPU overuse.

As far as I know, the thing that is used to slow down a server is the TCP SYN handshake, but that takes trivial amount of CPU.

How does one crash a server using (D)DoS?

Improve this question
2
  • 18
    Semantics comment: In no way does it "slow down the CPU". If anything it may speed it up!
    – jayjay
    Dec 22, 2016 at 13:36
  • 4
    It doesn't slow down the CPU, it keeps the CPU busy doing useless stuff, which reduces the amount of time it has for doing useful stuff.
    – user253751
    Dec 23, 2016 at 1:37

4 Answers 4

Reset to default
41

How does one crash a server using (D)DoS?

To specifically answer your question, to crash a server using only DDoS you need to target the Application Layer (detailed explanation below). These types of attacks specifically attempt to use up as much of the target servers resources a possible and bring it down, rather than just hammer it with network traffic.

However, to put this into context alongside other types of DDoS attacks, lets explore their major categories and their uses.

This article covers the 3 major attack types for DDoS. From the article:

DDoS attacks can be broadly divided into three types:

Volume Based Attacks

Includes UDP floods, ICMP floods, and other spoofed-packet floods. The attack’s goal is to saturate the bandwidth of the attacked site, and magnitude is measured in bits per second [sic] "(Bps)" [sic].

Protocol Attacks

Includes SYN floods, fragmented packet attacks, Ping of Death, Smurf DDoS and more. This type of attack consumes actual server resources, or those of intermediate communication equipment, such as firewalls and load balancers, and is measured in Packets per second.

Application Layer Attacks

Includes low-and-slow attacks, GET/POST floods, attacks that target Apache, Windows or OpenBSD vulnerabilities and more. Comprised of seemingly legitimate and innocent requests, the goal of these attacks is to crash the web server, and the magnitude is measured in Requests per second.

TL;DR - there are multiple types of DDoS attacks depending on what the attacker wants to achieve. Sometimes an attacker will just want to take up all the available bandwidth, other times they will try overwhelm the CPU.

It's worth noting that DDoS is just a distributed type of the generic 'Denial of Service' - it does not imply crashing a server at all, only preventing the server from doing whatever it's intended for, whether thats preventing actual business from taking place by using all bandwidth or otherwise.

Improve this answer
3
  • 5
    This answer doesn't answer the question as stated or provide an explicit challenge to the question's premises. If it's explained in more detail in the article, then the content that actually answers the question needs to be quoted here.
    – jpmc26
    Dec 22, 2016 at 3:07
  • 1
    Edited to specifically address question - thank you for pointing this out. Haven't edited the capitalisation however - though I agree with you, I have directly quoted the source here and feel it most appropriate to leave as per source.
    – R. Murray
    Dec 23, 2016 at 6:51
  • I think it is not so much what the attacker wants to achieve, as much as what is possible to achieve. For example, a volume attack may be possible against joetheplumber.com but impossible against google.com, and the opposite may be true of an application layer attack. In any case, the end result of a successful DDoS attack is always the same: Denial of service.
    – Fax
    Jan 30, 2019 at 12:35
18

A SYN flood isn't about exhausting CPU, it's about exhausting memory.

A TCP connection is established through what is known as a "three-way handshake". Traditionally, it works as follows:

  1. Client sends a SYN packet. Server receives the packet and allocates resources for tracking the connection.
  2. Server replies with a SYN/ACK packet.
  3. Client replies with an ACK packet, establishing the connection.

In a SYN flood, the attacker sends a continuous stream of SYN packets, while ignoring the SYN/ACK responses. This leaves the server with large numbers of halfway-opened connections that will stick around for a while; if the attacker can send packets fast enough, the server will be unable to respond to genuine requests. A poorly-written server might even run out of memory and crash.

The standard defense against SYN flooding is SYN cookies:

  1. Client sends a SYN packet.
  2. Server responds with a SYN/ACK packet with carefully-selected values for some TCP parameters that let it identify the responding ACK.
  3. Client responds with an ACK packet based on those parameters, establishing the connection. The server now allocates resources to track the connection.

By delaying the allocation of resources until the connection is fully established, there's no longer the asymmetry of effort that makes the flooding attack practical.

Improve this answer
1
  • 1
    A simpler way to describe this is that TCP is a "stateful" protocol. Each TCP connection requires the OS to remember "state" of each connection. SYN flood forces the OS to create as many "TCP connections" as possible, with the minimum of work.
    – Aron
    Dec 23, 2016 at 3:29
10

A DDoS usually doesn't crash a server. It overloads it, making it unavaible for normal use. The "best" way to achieve this depends on the function of the server and the way it's configured. There are plenty of ways to do this, to name a few:

  • overload the network interface with traffic so it's filled up with garbage and legit traffic isn't reaching the server
  • exhaust the firewall by creating a large number of sessions, so many it cannot keep track of the session state and will not accept new sessions
  • rapidly fire request (e.g. open web pages on a webserver) which require a lot resources to generate (for example complex computations or database lookups). This reduces the availability of the server process and increases the load on the CPU.
  • filling up disks, for example by creating a lot of log entries or uploading data
Improve this answer
2
  • To clarify, what do you mean by creating log entries?
    – DrDoom
    Dec 21, 2016 at 22:16
  • 1
    Typically, every request a server handles is logged, for example every HTTP request a web server receives is logged for analytics and statistics. If you generate many more requests than expected, the disk may be completely filled, possibly preventing other processes from writing things to disk. Also, if the server needs to write a lot of logs to disk this may affect speed of normal disk operations.
    – Teun Vink
    Dec 21, 2016 at 22:20
10

Usually DDoS attacks are what is called layer 4 attacks. These often use SYN floods and are aimed at exhausting all available bandwidth. Just like you can't download movies at an unlimited speed from your home computer, a server can not accept incoming requests and send outgoing responses at an unlimited rate. Sure, a server might have more bandwith than you do, but the biggest DDoS attacks are using up hundreds of gigabits per second!

Then there are what is called layer 7 attacks. These are often undistributed attacks aimed at some resource like CPU or disk space. While a layer 4 attack is one-size-fits-all, a layer 7 attack needs to be aimed at a specific weakness in the victim. Usually something very resource intensive (that is not cached) like full text search is used as a target. As you say, a SYN-ACK handshake isn't very resource intensive so that would be a poor choice for a level 7 attack.

So, in conclusion:

  • A layer 4 attack might use SYN packets, but is aimed at bandwith and not CPU use.
  • A layer 7 attack might be aimed at CPU use, but would not use SYN packets.
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .