There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol attacks target flaws in the protocols to overwhelm targeted resources.

What flaws in TCP make it vulnerable to DDOS? I'm not interested in other transport protocols.

  • 2
    One of the reasons for downvoting is "does not show any research effort" (hover over the downvote button to see this). I'm sorry but your question lacks research. A simple Google search for "TCP protocol Denial-of-service attack" (your title) will return answers for you. We expect that people have done at least a little research to answer the question themselves before posting. – schroeder Sep 11 '18 at 19:03
  • 1
    This is much like asking "What flaws in building design require a fire marshall to set maximum occupancy limits?" Buildings can only fit so many people. Networks can only support so much traffic. That's not so much a flaw in TCP as it is a flaw in the universe... – Conor Mancone Sep 12 '18 at 13:02

What flaws in TCP make it vulnerable to DDOS?

TCP is not vulnerable to DDOS per se except via resource exhaustion (and "lack of infinite resources" is unavoidable, so not really a flaw). TCP is often used as a method of DDOS, simply by inputting more traffic into the system than it can handle.

But TCP is to DDOS as the road is to a bank robber - the fact that they jump in their car and drive off after the robbery does not make the road vulnerable or flawed.

It's important to remember that the operative word in DDOS is "Service". Only when a Service is being offered can the be used, and then over-used, in order to Deny Service. The Service has to be available, so the tools used to make it available (like TCP) are necessary and not flaws or vulnerabilities.

So the "flaw" in TCP is - it allows access to the Service. And a DDOS is just more attempts to use the Service than the network and hosts involved can handle. Not a flaw, just overuse.

  • 1
    @schroeder Appreciated... but I'm skipping SYN floods as I've removed UDP (which would be the analogous "fire-and-forget"). Don't really consider that a "flaw", just "more of as designed". Even overlapping windows isn't a flaw so much as an implementation pitfall. – gowenfawr Sep 11 '18 at 14:44

Not the answer you're looking for? Browse other questions tagged or ask your own question.