1

I have Layer3 ddos protection, but I want to upgrade it to Layer7 ddos protection. But when i look about Layer7 Ddos attacks, I see that they are usually HTTP/HTTPS based attacks. I have 3 questions;

  1. What is other Layer7 DDos attacks, e.g FTP, DNS ?
  2. If I use WAF instead of Layer7 ddos protection, what will be risks in my system?
  3. Using WAF for ddos protection is a prefered way?
7
  • Can you clarify that the application you're protecting is a HTTP web-service?
    – brynk
    Mar 3, 2021 at 7:08
  • I protected HTTP/s web service via WAF. But is it enough? what about my ftp, dns servers?
    – banker
    Mar 3, 2021 at 7:10
  • You can use WAF and DDoS protection in parallel (they're not mutually exclusive). In fact, WAF-only will likely not protect you against a Distributed Denial of Service (DDoS) attack. WAF will scrutinise the actual protocol requests that would be sent to the HTTP service.
    – brynk
    Mar 3, 2021 at 7:13
  • DDoS protection may also protect your FTP service, while a Web Application Firewall (WAF) probably won't.
    – brynk
    Mar 3, 2021 at 7:18
  • 2
    "I have two questions : 1. ... 2. ... 3. ..." - hm. Mar 3, 2021 at 10:45

1 Answer 1

2

1.What is other Layer7 DDos attacks, e.g FTP, DNS ?

Application layer attacks or layer 7 (L7) DDoS attacks refer to a type of malicious behavior designed to target the “top” layer in the OSI model where common internet requests such as HTTP GET and HTTP POST occur. These layer 7 attacks, in contrast to network layer attacks such as DNS Amplification, are particularly effective due to their consumption of server resources in addition to network resources.

2.If I use WAF instead of Layer7 ddos protection, what will be risks in my system?

WAF can mitigate ddos attack in under certain level. Application layer ddos attacks are very difficult to avoid. Specially bot net attacks are not spoofed and request seems to be fully legitimate.

3.Using WAF for ddos protection is a prefered way?

You have to use adaptive technology like a captcha code. Because botnet attacks are very difficult to identified from legitimate traffic therefore captcha will be best solution.

Web application Firewall also option. Please Read link.

(Details copied from cloudflare)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.