0

I wonder what is the volume of traffic, in terms of requests/second, forms a legit DDoS attack against a website. I know it highly depends on the website and where it is hosted. But is there any real-world example that at least gives some numbers. For example, for 10M request/second, what size of website can be taken down?

I can only find some online news such as GitHub Survived the Biggest DDoS Attack Ever Recorded, but it is not very easy to interpret the unit they use, i.e., 1.3 Tbps, into number of HTTP requests from technical point of view. If interpret literally, one regular HTTP request include tens of headers that may range from few hundreds to few thousands of characters, and then count for a few thousands Bytes and then tens of thousands bits. If calculate this way, assuming a request is with size 5Kb on average, then 1.3 Tb would be roughly 200 million requests. But I don't think it is the right way to consider.

  • 1
    HTTP is not the only protocol to use for a DDoS, see this answer – iraleigh May 7 at 23:10
  • 1
    10MBps? It depends on how the server is processing the request. If the attack requests something that demands a lot of processing (like login forms with pbkdf2 or blake), it can make the server load skyrocket. 10MBps of serving static content is easy. – ThoriumBR May 8 at 0:25
  • I meant 10 million concurrent HTTP request. – SamTest May 8 at 2:16
  • I'm not sure what you are asking for, really. Are you asking the best way to measure DDoS? Why is BPS not enough? Why are you focused on "requests"? What makes a DDoS "legit"? "Size" of website also doesn't matter. I think you need to rethink your foundations for the question. There are a ton of unexampled assumptions here. – schroeder May 8 at 14:30
  • @schroeder, no offence, but I knew there would be answers like yours. I know there are a lot of details that I did not specify, and that is exactly what I am asking. BPS is not "not enough", but I do not know how it is calculated. I am a network person, and I know there are a lot of interpretations just to calculate bps and Bps. How are bits calculated, does it include packet headers/trailers? Why am I focus on "request" is because I think layer 7 DoS is easier, you just find bots and send requests, rather than manipulate 2nd or 3rd layers. – SamTest May 8 at 19:56
2

Link11 (a European security firm providing DDoS protection) reports that in 2020 the bandwidth of an average attack to their customers was about 5 Gbps, and the maximum bandwidth was about 400 Gbps. Source: https://www.helpnetsecurity.com/2020/04/20/ddos-attacks-increasing/

A recent post on Cloudflare's blog reports that over 60% of the attacks are under 500 Mbps, and almost 30% of the attacks are between 500 Mbps and 10 Gbps. The largest attack they have seen recently was about 550 Gbps. Source: https://blog.cloudflare.com/ddos-attacks-have-evolved-and-so-should-your-ddos-protection/

What does that tell you? Not much. It just tells you that cyber criminals can afford a lot of bandwidth, but most of the time the attacks just need a few Gbps to be effective. From the above article by Cloudflare:

Even though 10 Gbps from an attack size perspective does not seem that large, it is large enough to significantly affect a majority of the websites existing today".

It's difficult to come up with specific examples or general answers to your questions though. There are a lot of different types of DoS attacks, at different levels and with different techniques. Some use empty packets, other use specific packets, other target specific high-level protocols, other focus on the application rather than the network, and so on. So if you have a 10 Gbps attack, that's 10 Gbps of... what? Bogus TCP packets? SMTP connections? HTTP requests to a large image file? HTTP POST requests to run a cpu-intensive task? Who knows. So your question is way too broad.

| improve this answer | |
  • I know my question is broad and you just nailed it. Thanks for your answer then I can ask more specific question. Based on your example, "you have 10 Gbps", does it refers to the uplink or downlink? I should have mentioned I am interested in layer 7 DoS, specifically HTTP. As I asked in the question, assume one HTTP request is 5Kb, then 1 million concurrent HTTP requests would count 5Gb, is it then considered an effective DoS against the web server and significantly slow it down? – SamTest May 8 at 20:09
  • And does it also mean, if I can only send half million requests as an attacker, I can choose to send a 10Kb size HTTP request to achieve the same effect against the server? – SamTest May 8 at 20:11
  • @SamTest, honestly I don't know, and I suspect it's difficult to find a precise definition because modern DDoS attacks seem to be "multi-vector" attacks, meaning they combine several types of methods and attack multiple layers. I suppose Gbps in "volumetric" attacks always refers to incoming traffic, but in HTTP-request based attacks it would make sense to also consider outgoing traffic. See this link to understand why it's difficult to answer your questions: securityboulevard.com/2019/05/… – reed May 11 at 10:55
  • @SamTest, in other words, I wouldn't obsess too much over the Gbps measurements. You need to ask yourself: what do I want to saturate? Send lots of packets to saturate the routers? Send lots of data to saturate the incoming bandwidth? Request lots of data to saturate the outgoing bandwidth? Saturate CPU, RAM, DB requests, or available sessions? Or use several of these vectors together? As you can see, it's not easy to give precise measurements or make calculations based on Gbps only. – reed May 11 at 11:02
  • thank you. Your answer makes much sense. I get very confused when I see people talking about DDoS attack that reaches to xx Mbps, now at least I know my confusion is legit. – SamTest May 12 at 15:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.