40. DoS and DDoS – Availability Attacks
40.1 What Is DoS vs DDoS – Availability First
DoS (Denial of Service) = one source (or few) overwhelms a target so legitimate users cannot use it. DDoS (Distributed DoS) = many sources – often a botnet – hit the same target together. Goal is break availability (उपलब्धता), not steal the database secretly.
Three CEH-style buckets defenders use:
| Class | Simple idea | Blue focus |
|---|---|---|
| Volumetric | Fill the pipe (Gbps / packets per second) | ISP / cloud scrubbing, Anycast, capacity |
| Protocol | Abuse handshake / state (SYN flood, etc.) | SYN cookies, firewall state limits |
| Application-layer | Cheap requests that hurt CPU/workers (HTTP flood, slowloris-class) | Rate limit, WAF, timeouts, sizing |
Thodkyaat: DoS = ek gadi traffic jam; DDoS = sheharaatlya saarya gadyanna ekach chowk. Samjla ka?
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Single VPS floods lab / small site (classic DoS) | Per-IP rate limit; fail2ban-style blocks; upstream ACL |
| Botnet / many IPs for DDoS | ISP scrubbing centre; Anycast CDN; geo / ASN filters |
| Mix volumetric + app-layer so one control fails | Layered: network scrub + WAF + origin hardening |
Ravindra Bagale's Tip
Students say "DoS = hacking a password". No – stealing a password is about confidentiality/identity. DoS = making a site/service unavailable. In interviews, clearly name the A from CIA. Remember this.
Ravindra Bagale's Tip – मराठी
Students "DoS = hack password" म्हणतात. नाही – password चोरी = confidentiality/identity. DoS = site / service unavailable. Interview मध्ये CIA मधला A clear सांगा. हे लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "DoS = hack password". नहीं – password चोरी = confidentiality/identity. DoS = site / service unavailable. Interview में CIA का A clear बताओ. यह याद रखो.
Lab
Notes madhe 6-row table: DoS | DDoS | volumetric | protocol | application-layer | botnet – ek-ek line def + one Blue control. Fictional Raja-Rani Traders online order page Pune – Rani mhante "site slow aahe festival la". Kontya class chi pahili suspicion? 5 sentences.
Real incident: Dyn DNS (2016)
On 21 October 2016, Dyn's managed DNS infrastructure was hit by large DDoS waves publicly linked to Mirai-class IoT botnets. Public reporting (Dyn analysis summary, Krebs on Security, major outlets) described disruption for users reaching many popular sites that depended on that DNS. Defence theme: harden IoT defaults, DNS provider resilience, multi-provider DNS where business-critical. Source: Dyn public analysis / Krebs / Cloudflare Mirai retrospectives (verify; do not invent peak Tbps figures beyond what sources state).
Extended teaching notes
Why this lesson matters
Availability attacks try to exhaust bandwidth, connections or app workers. Learning them is about detection and defence — never about stressing networks you do not own (that can be illegal and harmful).
- Rate limits and WAF/CDN at the edge.
- SYN cookies / tuning on servers.
- Autoscaling with care (cost controls).
- Keep IoT devices off default passwords (Mirai lesson).
- Lab simulations only on isolated networks you own.
Mini case study
Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.
Defender's worksheet (do this today)
- Write the lesson title, date and the exact lab target you are allowed to use.
- List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
- Run one safe check from the lesson on a lab system only. Paste the command and output.
- Write a two-sentence fix you would give a teammate.
- Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.
Indian workplace (sample data)
Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).
Global practice
Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.
Everyday analogy
Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.
Key terms
- Control: a safeguard (patch, config, process, detection).
- Finding: a weakness backed by evidence.
- Remediation: the fix plus how you verified it.
- Scope: systems you have written permission to touch.
- Least privilege: only the access the task needs.
- Defence in depth: several layers so one failure does not end the story.
Common mistakes
- Skipping written permission "just for a quick scan".
- Practising on hostel, office or public targets without authorisation.
- Collecting tool output without writing the fix.
- Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
- Publishing screenshots that contain secrets, cookies or internal hostnames.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Fix > spectacle.