I read some explains or paper about link flooding DDoS attack, which is new relatively.

For example

I want to know how link flooding DDoS attack works, for example,

  • how employs legitimate traffic? what means attack selected links? how to remain undetected? etc.
  • It sounds like this DDoS is just trying to simulate multiple simultaneous instances of the Slashdot Effect in order to not be detected as an attack. At least that's what I get reading the abstract.
    – forest
    Dec 9, 2018 at 7:12

1 Answer 1


...I want to know how link flooding DDoS attack works...

The authors of the second paper (SPIFFY) provide two references in the first sentence of the introduction: The Coremelt Attack and The Crossfire Attack. From reading the abstract and introduction of these papers it looks like the basic idea is that a selected network path is saturated with large amounts of normal traffic. The source of this traffic is an attacker controlled botnet and the many targets are either from a botnet too or just normal public servers. Due to saturation of this link any connectivity over this link is negatively affected, i.e. a denial of service.

... how to remain undetected?

Given that this is normal traffic (i.e. HTTP or similar) between many sources and many targets it does not look like the typical DDoS which is directed against one or a few systems. Instead it looks like normal traffic and thus existing DDoS detection heuristics don't get triggered.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .