Most engineers think…
Most people picture DDoS as 'a huge flood of traffic that fills your internet pipe'. That mental model only describes one of three families and will trip you up in an interview and in the SOC.
DDoS attacks fall into three families that hit different layers: volumetric floods saturate bandwidth at L3/4, protocol attacks exhaust stateful resources like connection tables, and application-layer (L7) attacks drain web and app server resources with seemingly legitimate requests at tiny bandwidth. Because no single defence covers all three, modern attacks are usually multi-vector. Radware DefensePro and Cloud DDoS Protection answer each layer with a different mechanism — and understanding that mapping is exactly what lets you read an attack, pick the right control, and stop a zero-day flood in seconds without blocking real users.
① The three DDoS families — by layer and by target
The single most important idea: DDoS is not one attack. It is three families that hit different layers and exhaust different resources. Get the family right and the defence almost picks itself.
Volumetric attacks (L3/4) aim at one thing — bandwidth saturation. UDP and ICMP floods, plus reflection/amplification, blast packets until the pipe is full. Protocol / state-exhaustion attacks (L3/4) target the state tables of servers, firewalls and load balancers — SYN floods leave half-open connections, ACK and fragment floods waste reassembly and stateful resources. Application-layer (L7) attacks target web and app server logic with legitimate-looking requests — HTTP floods, Slowloris and DNS query floods.
The interview line: because each family attacks a different resource, no single control stops all three, and real-world attacks combine vectors. You need bandwidth defence, state-exhaustion defence and L7 defence working together.
Why does no single control stop every DDoS attack?
② Volumetric & amplification — small requests, terabit floods
Volumetric attacks win by sheer volume. Plain UDP and ICMP floods simply send huge packet rates to exhaust pipe capacity. The frightening multiplier is reflection/amplification: the attacker spoofs the victim's source IP and queries open servers, which then send oversized replies to the target.
The amplification factors you must name
DNS amplification runs about 10–50x. NTP MONLIST (CVE-2013-5211) returns the last 600 client IPs for roughly 556.9x. memcached on UDP port 11211 is the monster — a 203-byte request can trigger a ~100 MB reply, around 50,000x, which powered the 2018 GitHub ~1.3 Tbps attack.
Radware answer: behavioral detection flags volume and rate anomalies, DefensePro auto-generates a real-time signature characterising the flood, and rate limiting kicks in — while volumes beyond the local pipe divert to Radware cloud scrubbing centers.
Ratio of reflected response size to attacker request size — about 50x for DNS, 556x for NTP MONLIST and ~50,000x for memcached on UDP 11211.
A TCP session stuck after SYN/SYN-ACK with no final ACK. SYN floods pile these up to exhaust the server's backlog; SYN cookies defeat them.
Radware's baseline-learning engine that detects unknown/zero-day floods and auto-generates a real-time signature — often in under ten seconds.
An encrypted, randomised HTTPS flood designed to evade rate-based L7 defences — blocked by behavioral TLS fingerprinting without decryption.
The whole trick of amplification is that the attacker forges the victim's source IP, so open DNS/NTP/memcached servers send their oversized replies straight to the target. In an interview, say 'spoofed victim IP plus a high amplification factor' and you have nailed it.
memcached amplification abuses which UDP port, and why is it so dangerous?
③ Protocol & application-layer — bandwidth-light, resource-deadly
These families barely move the bandwidth needle, yet they take services down. Protocol / state-exhaustion attacks abuse how stateful devices track connections. A SYN flood sends spoofed TCP SYNs; the server allocates a half-open connection for each and waits for a final ACK that never comes, exhausting the backlog. ACK floods and fragmented-packet attacks waste reassembly and stateful resources on firewalls and load balancers.
Application-layer (L7)
HTTP/HTTPS floods send valid-looking GET/POST requests to overwhelm app and database tiers. Web DDoS 'Tsunami' floods use encrypted, randomised requests to evade rate rules. Slowloris opens many connections and sends partial headers slowly to tie up every server thread at very low bandwidth — volume alarms stay quiet while threads silently fill. DNS query floods swamp DNS servers with unique lookups.
The interview line: watch the right meter. If bandwidth is flat but connections or request anomalies spike, you are looking at protocol or L7 — not a volumetric flood.
If you only watch bits-per-second you will miss SYN floods and Slowloris entirely — they barely register on bandwidth. Always check connection-table and request-rate anomalies too, or you will declare 'all clear' while the service is down.
A web server shows thousands of open connections, near-zero bandwidth and a very low request rate. Which attack is this?
④ How Radware mitigates each layer — the mechanism per family
Radware maps a specific mechanism to each family. Volumetric: behavioral baselining flags rate/volume deviations, DefensePro synthesises a real-time signature (often under 10 seconds) and applies rate limiting; overflow diverts to cloud scrubbing. Protocol: SYN Protection with SYN cookies answers SYNs statelessly and only allocates state after a completed handshake. Application-layer: L7 behavioral analysis profiles normal request patterns, challenge/authentication weeds out bots, and behavioral TLS/HTTPS fingerprinting blocks encrypted floods without decryption; per-source connection and request limits kill slow-and-low attacks like Slowloris.
Known vs zero-day
The cross-cutting split: 'DoS Shield' handles known floods via signatures, while Behavioral-DoS (BDoS) handles unknown/zero-day floods — it learns a baseline, detects the anomaly and synthesises a fresh signature automatically, minimising false positives on legitimate traffic.
Arjun Mehta, network security engineer at Sankhya Networks, Pune
A customer's e-commerce site is unreachable; the front-end web servers show thousands of open connections but near-zero bandwidth usage and a very low request rate.
A Slowloris L7 attack — many half-sent HTTP requests holding every server thread open — not a bandwidth flood, which is why volumetric counters stay flat.
In APSolute Vision he sees a spike in concurrent connections-per-source with abnormally long-lived, incomplete HTTP sessions and a behavioral L7 anomaly, while volumetric counters stay flat.
APSolute Vision ▸ DefensePro ▸ device ▸ Network Protection / BDoS & Connection-LimitEnable and tighten the Connection Limit and L7 Behavioral (BDoS/HTTP) protections in the policy, set per-source concurrent-connection and request-timeout thresholds, and turn on challenge/authentication for suspicious clients.
The connection table drains, the auto-generated signature shows blocked offending sources in the attack log, and a synthetic Slowloris test from a lab IP is dropped while normal shoppers load the site.
Never close a DDoS ticket on 'traffic looks normal now'. Read the DefensePro attack log: it shows the auto-generated signature, the blocked sources and the attack vector. That single read confirms which family hit you and that it is actually mitigated.
▶ Watch a zero-day volumetric flood get auto-mitigated
How DefensePro stops an unknown flood end-to-end. Press Play for the healthy path, then Break it to see the classic failure.
How does Radware stop a brand-new zero-day flood with no vendor signature available yet?
🤖 Ask the AI Tutor
Tap any question — instant, scoped to this lesson. No login, no waiting.
Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in.
📝 Wrap-up assessment — six more
You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end.
🧠 In your own words
Type one line: why does Radware use a different mechanism for each DDoS family instead of one universal control? Then compare with the expert version.
🗣 Teach a friend
Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary.
📖 Glossary
- Volumetric attack
- DDoS that saturates bandwidth with high packet/bit volume — UDP/ICMP floods and reflection/amplification.
- Protocol attack
- DDoS that exhausts stateful resources like connection tables — SYN, ACK and fragment floods.
- Application-layer (L7) attack
- DDoS targeting web/app logic with legitimate-looking requests — HTTP floods, Slowloris, DNS query floods, Web DDoS Tsunami.
- Reflection / amplification
- Spoofing the victim's IP so open servers (DNS/NTP/memcached) send large unsolicited replies to the target.
- SYN cookie
- A stateless handshake technique that defers resource allocation until a valid ACK arrives, defeating half-open SYN floods.
- Slowloris
- A low-bandwidth L7 attack that holds many connections open with slow partial HTTP requests to tie up server threads.
- Behavioral-DoS (BDoS)
- Radware's baseline-learning engine that detects zero-day floods and auto-generates real-time signatures, often in under ten seconds.
- DoS Shield
- Radware signature-based protection against known DDoS floods.
- Cloud scrubbing
- Diverting attack traffic to off-prem centers that clean it and forward only legitimate traffic to the protected site.
📚 Sources
- Radware — DefensePro: Advanced DDoS Defense and Attack Mitigation. radware.com
- Radware — DDoS Mitigation Layers with DefensePro (Behavioral-DoS, DoS Shield, SYN Protection). radware.com
- Imperva — What is NTP Amplification | Mitigation Techniques. imperva.com
- Cloudflare — Memcrashed: Major amplification attacks from UDP port 11211. blog.cloudflare.com
- NETSCOUT — What is a SYN flood attack and how to prevent it?. netscout.com
- NETSCOUT — What is a Slowloris DDoS Attack?. netscout.com
What's next?
Got the attack families? Next, go deep on Radware Behavioral-DoS internals — how it baselines normal traffic, detects rate and rate-invariant anomalies, and synthesises a real-time signature in under ten seconds without flooding the SOC with false positives.