40. DoS and DDoS – Availability Attacks
40.1 What Is DoS vs DDoS – Availability First
DoS (Denial of Service) = one source (or few) overwhelms a target so legitimate users cannot use it. DDoS (Distributed DoS) = many sources – often a botnet – hit the same target together. Goal is break availability (उपलब्धता), not steal the database secretly.
Three CEH-style buckets defenders use:
| Class | Simple idea | Blue focus |
|---|---|---|
| Volumetric | Fill the pipe (Gbps / packets per second) | ISP / cloud scrubbing, Anycast, capacity |
| Protocol | Abuse handshake / state (SYN flood, etc.) | SYN cookies, firewall state limits |
| Application-layer | Cheap requests that hurt CPU/workers (HTTP flood, slowloris-class) | Rate limit, WAF, timeouts, sizing |
Thodkyaat: DoS = ek gadi traffic jam; DDoS = sheharaatlya saarya gadyanna ekach chowk. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Single VPS floods lab / small site (classic DoS) | Per-IP rate limit; fail2ban-style blocks; upstream ACL |
| Botnet / many IPs for DDoS | ISP scrubbing centre; Anycast CDN; geo / ASN filters |
| Mix volumetric + app-layer so one control fails | Layered: network scrub + WAF + origin hardening |
Ravindra Bagale's Tip
Students "DoS = hack password" mhantat. Nahi – password chori = confidentiality/identity. DoS = site / service unavailable. Interview madhe CIA madhun A clear bola. He lakshat theva.
Lab
Notes madhe 6-row table: DoS | DDoS | volumetric | protocol | application-layer | botnet – ek-ek line def + one Blue control. Fictional Raja-Rani Traders online order page Pune – Rani mhante "site slow aahe festival la". Kontya class chi pahili suspicion? 5 sentences.
Real incident: Dyn DNS (2016)
On 21 October 2016, Dyn's managed DNS infrastructure was hit by large DDoS waves publicly linked to Mirai-class IoT botnets. Public reporting (Dyn analysis summary, Krebs on Security, major outlets) described disruption for users reaching many popular sites that depended on that DNS. Defence theme: harden IoT defaults, DNS provider resilience, multi-provider DNS where business-critical. Source: Dyn public analysis / Krebs / Cloudflare Mirai retrospectives (verify; do not invent peak Tbps figures beyond what sources state).