How are server overload and DoS/DDos different?

Question

I know that server overloads are caused due to excessive number of genuine requests and DoS due to malicious request. But, my question is, if you have designed a system for Overload mitigation, does it necessarily protect system from DoS? If not why?

Answer 1

The difference is intent.

In the normal overload case, your server has perhaps become very popular and is receiving a huge number of legit requests. (E.g. front page of digg/slashdot.)

In a (D)DoS, the attacker is intentionally trying to overload your server. So the attacker would design the attack in a way that would defeat certain mitigation strategies -- especially taking advantage of the application(s) running on the server in order to consume either excess bandwidth, CPU, etc.

A lot would depend on your application, but as a simple example: A mitigation strategy designed to withstand simply "being slashdotted", say by serving a static copy of your front page, could be easily defeated by generating tons of requests for deep pages, or for your search functionality, or for a large file, or by hitting your CAPTCHA image generator particularly hard.

Answer 2

Denial of Service is a broad term, describing attacks that "make a computer resource unavailable to its intended users" (Wikipedia). Overloading a server is a form of DoS, but there are many other forms. You might be able to achieve the same goal by using up the server's maximum number of possible concurrent connections, not overloading the server, but using up a resource. Or by abusing a memory corruption bug Wikipedia that makes the server software crash.

So, by protecting your server against overload, you protect it against one form of DoS.

Answer 3

A server overload is one type of DoS, but DoS can mean any type of denial of service, whether it its CPU, network, disk or other service.

Mitigation is a good idea, but the problem with DDoS is that an attacker can use thousands of devices to attack you, which means your mitigation strategy needs to be very robust, not only dealing with load but deflection techniques.