DoS and DDoS attacks in Computer Networks - Step-by-Step Execution

Concept Flow - DoS and DDoS attacks

Start: Attacker plans attack

↓

Launch DoS or DDoS attack

↓

Target server/network receives many requests

↓

Server resources get overwhelmed

↓

Server slows down or crashes

↓

Service becomes unavailable to real users

↓

Attack ends or is mitigated

The attacker sends many requests to a server to overwhelm it, causing it to slow down or stop working, making the service unavailable.

Execution Sample

Computer Networks

Attacker sends 1000 requests per second to server
Server processes requests until overloaded
Server response slows or stops
Users cannot access service

This shows how an attacker floods a server with requests, causing it to become overloaded and unavailable.

Analysis Table

Step	Action	Requests Received	Server Load	Server Response	Effect on Users
1	Attack starts	100 requests/sec	Low	Normal	Users access normally
2	Requests increase	500 requests/sec	Medium	Slower	Users notice delays
3	Requests flood	1000 requests/sec	High	Very slow	Users struggle to connect
4	Server overwhelmed	2000 requests/sec	Overloaded	No response	Users cannot access service
5	Attack stops or mitigated	Normal traffic	Normal	Normal	Users regain access

💡 Attack ends or server recovers, normal service resumes

State Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Requests Received	0	100	500	1000	2000	Normal
Server Load	Low	Low	Medium	High	Overloaded	Normal
Server Response	Normal	Normal	Slower	Very slow	No response	Normal
User Access	Normal	Normal	Delayed	Struggling	Unavailable	Normal

Key Insights - 3 Insights

Why does the server slow down before it completely stops responding?

As shown in steps 2 and 3 in the execution_table, the server load increases gradually with more requests, causing slower responses before it becomes fully overloaded.

What is the difference between DoS and DDoS attacks?

DoS uses one attacker machine to flood the server, while DDoS uses many machines simultaneously, making the attack stronger and harder to stop. This is implied in the 'Requests Received' increasing rapidly in the table.

Why do users struggle to connect before the server completely fails?

Because the server response slows down as load increases (steps 2 and 3), users experience delays and connection issues before total failure.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the server become overloaded?

A Step 3

B Step 4

C Step 2

D Step 5

💡 Hint

Check the 'Server Load' column in the execution_table rows.

According to variable_tracker, what happens to 'User Access' after Step 3?

A Struggling

B Normal

C Delayed

D Unavailable

💡 Hint

Look at the 'User Access' row and the value after Step 3.

If the attacker sends fewer requests, how would the 'Server Response' change in the execution_table?

A It would become 'Very slow' immediately

B It would become 'No response' faster

C It would stay 'Normal' longer

D It would not change

💡 Hint

Consider how 'Requests Received' affects 'Server Response' in the execution_table.

Concept Snapshot

DoS and DDoS attacks flood a server with excessive requests.
DoS uses one source; DDoS uses many sources.
Server load increases, causing slow or no response.
Users cannot access the service during attack.
Mitigation restores normal service.

Full Transcript

A Denial of Service (DoS) attack happens when an attacker sends many requests to a server to overwhelm it. This causes the server to slow down or crash, making the service unavailable to real users. A Distributed Denial of Service (DDoS) attack is similar but uses many computers to send requests at once, making it stronger. The attack starts with low requests and grows until the server is overloaded. Users first notice delays, then cannot access the service. When the attack stops or is stopped, the server recovers and users regain access.

Practice

1. What is the main difference between a DoS attack and a DDoS attack?

easy

A. DoS attacks use viruses; DDoS attacks use worms.

B. DoS attacks websites; DDoS attacks only servers.

C. DoS uses one attacker; DDoS uses many attackers.

D. DoS attacks are legal; DDoS attacks are illegal.

Solution

1. Step 1: Understand DoS attack

   A DoS (Denial of Service) attack involves a single attacker trying to overload a system to make it unavailable.

2. Step 2: Understand DDoS attack

   A DDoS (Distributed Denial of Service) attack involves many attackers working together to overload the system.

3. Final Answer:

   DoS uses one attacker; DDoS uses many attackers. -> Option C

4. Quick Check:

   DoS = single attacker, DDoS = multiple attackers [OK]

Hint: Remember: D in DDoS means Distributed (many attackers) [OK]

Common Mistakes:

• Thinking DoS and DDoS differ by target type
• Confusing legality of attacks
• Believing DoS uses viruses

2. Which of the following is a correct description of a DDoS attack?

easy

A. Multiple computers send requests to a server simultaneously.

B. A single computer sends many requests to a server.

C. A server sends requests to multiple clients.

D. A user accidentally overloads their own computer.

Solution

1. Step 1: Identify DDoS attack behavior

   DDoS attacks involve many computers sending requests at the same time to overload a server.

2. Step 2: Eliminate incorrect options

   A single computer sends many requests to a server. describes a DoS attack, not distributed. Options C and D do not describe attacks.

3. Final Answer:

   Multiple computers send requests to a server simultaneously. -> Option A

4. Quick Check:

   DDoS = many computers attacking together [OK]

Hint: DDoS means many computers attack at once [OK]

Common Mistakes:

• Confusing single computer attack with DDoS
• Thinking server sends requests in DDoS
• Mixing accidental overload with attack

3. Consider this scenario: A website receives 1000 requests per second from one IP address, and 10,000 requests per second from 100 different IP addresses. Which attack is more likely happening?

medium

A. DoS attack from one IP address

B. DDoS attack from multiple IP addresses

C. Normal traffic spike

D. Phishing attack

Solution

1. Step 1: Analyze request sources

   One IP sending 1000 requests per second suggests a DoS attack. Multiple IPs sending 10,000 requests per second suggests a DDoS attack.

2. Step 2: Identify attack type

   Since 100 different IPs are involved, this matches the definition of a DDoS attack.

3. Final Answer:

   DDoS attack from multiple IP addresses -> Option B

4. Quick Check:

   Multiple IPs attacking = DDoS [OK]

Hint: Multiple IPs flooding = DDoS, single IP flooding = DoS [OK]

Common Mistakes:

• Choosing DoS for multiple IPs
• Confusing phishing with DoS/DDoS
• Assuming normal traffic causes overload

4. A network admin notices a sudden drop in website availability. They suspect a DDoS attack but find only one IP address flooding the server. What is the likely issue?

medium

A. The server is down due to hardware failure.

B. The attack is a phishing attempt.

C. The admin misread the logs; multiple IPs are attacking.

D. The attack is actually a DoS, not DDoS.

Solution

1. Step 1: Check attack source IPs

   DDoS attacks involve many IPs; only one IP means it is a DoS attack.

2. Step 2: Confirm attack type

   Since only one IP floods the server, the problem is a DoS attack, not DDoS.

3. Final Answer:

   The attack is actually a DoS, not DDoS. -> Option D

4. Quick Check:

   One IP flooding = DoS, not DDoS [OK]

Hint: One IP flooding means DoS, not DDoS [OK]

Common Mistakes:

• Assuming single IP means DDoS
• Ignoring hardware failure possibility
• Confusing phishing with DoS/DDoS

5. A company wants to protect its website from DDoS attacks. Which combination of strategies is most effective?

hard

A. Use a firewall, deploy traffic filtering, and employ a content delivery network (CDN).

B. Only install antivirus software on the server.

C. Disable the website during peak hours to avoid attacks.

D. Use a single strong password for all network devices.

Solution

1. Step 1: Identify effective DDoS defenses

   Firewalls can block unwanted traffic, traffic filtering can limit suspicious requests, and CDNs distribute traffic to reduce overload.

2. Step 2: Evaluate other options

   Antivirus alone does not stop DDoS. Disabling the site is not practical. Password strength helps security but not DDoS protection alone.

3. Final Answer:

   Use a firewall, deploy traffic filtering, and employ a content delivery network (CDN). -> Option A

4. Quick Check:

   Multiple layered defenses best protect against DDoS [OK]

Hint: Combine firewall, filtering, and CDN for best DDoS defense [OK]

Common Mistakes:

• Relying only on antivirus
• Thinking disabling site stops attacks
• Ignoring network traffic controls