DoS on an ordinary IP [duplicate]

Question

So, I understand DoSing to an HTTP Server. I understand Layer 7 DoS attacks and how to even make these work.

But what for an normal IP that isn't HTTP and is connected to the internet. Is the only way to attack them is by a bandwidth DDoS, which can be only done by more than 1 computer?

Pretend, I had my next door neighbors Internet protocol address. What is the most efficient way I can take it down or give it heavy load without requiring a bot net.

I'd like to know so I can protect my own IP so please answer without getting the wrong idea.

Answer 1

There are several ways to DoS an individual IP address, and to answer you're question you can still use an HTTP DoS attack if they have an HTTP port that's open, so ultimately the best type of DoS attack you would execute on an individual IP address directly relates to the results of a port scan or other methods of reconnaissance and information gathering you would have to complete on that sole IP.

Answer 2

DDoS ovetloads the capacity of a device to process requests and forces it to miss valid requests. In that sense, it matters not what the target protocol is, assuming you have a high-enough bandwidth as an attacker.

Imagine that your wifi router is set to full block mode on external WAN network. By directing several Gbs of invalid requests at it, the simple router will be focused at contineously dropping the invalid requests, overloading it's CPU capacity. Since requests keep coming, the router will lock-up, causing denial of service to valid users, even having no clearly visible attack surface. This is due to the fact that blocking firewall rule is still a rule, hense it has impact on the device (even if tiny).

The difference between a dumb flood into nothing and an HTTP floor, or Syn flood is that the victim actively interacts with your invalid requests, eating up more CPU time on the device and therefore making the ammount of traffic needed to knock the victim off less.

A good (theoretical) example of required traffic to disable a network device can be seen in the following scenario:

Firewall Drop Rule: 3gbs

Syn Flood against any open TCP port: 0.5Gbs

Requests to an insecure, resource intensive, http search query: 10Mbs

As you can see, the more CPU cycles you force the target to use, the more effective the DDoS attack.

Answer 3

If there are no services or ports open to the Internet on that IP address, then my understanding is that the only way to take down that IP is to saturate the connection by sending random data to that IP. The firewall will block it of course, but by the time it reaches the firewall the victim's download bandwidth will already have been consumed.

Theoretically speaking, it is possible to do it with just one computer, considering that we're talking about residential and not server-grade connections: If your own upload speed is greater than the victim's download speed, then one computer would be enough.

If this is not the case, it can still be done without a botnet using a DNS or NTP amplification attack. DNS and NTP are UDP protocols, so it is possible to spoof the IP address of the source (unlike with TCP). If you find a poorly secured public DNS or NTP server (ie, one that does not have rate limiting), you can send tons of queries spoofing the IP address of the victim, and the server will end up trying to send responses to the victim's IP address. If you send a small query that generates a large response, then you can send relatively little traffic to the server while the server sends large amounts of traffic to the victim (hence "amplification"). Essentially, you'd be leveraging the server's bandwidth to launch the attack.

As for ways to protect yourself against this, I don't think there is any - if you see an attack like this launched against your home connection, you should probably just call your ISP. If they're competent, they'll probably monitor your connection, realize what's happening, and then just null route your IP address and give you a new one.