# DDoS Attack Types & How Radware Mitigates Them — Volumetric, Protocol & Application-Layer Source: https://ai.techclick.in/blog_radware_ddos_attack_types Markdown: https://ai.techclick.in/blog_radware_ddos_attack_types.md Publisher: Techclick Infosec Pvt Ltd A clear, interactive guide (2026) to the three DDoS attack families — volumetric (UDP/ICMP floods and DNS/NTP/memcached amplification), protocol/state-exhaustion (SYN, ACK, fragment floods) and application-layer L7 (HTTP floods, Web DDoS Tsunami, Slowloris, DNS query floods) — and exactly how Radware DefensePro and Cloud DDoS Protection stop each with Behavioral-DoS, real-time signatures, SYN cookies, rate limiting, L7 challenge and TLS fingerprinting. DDoS Attack Types & How Radware Mitigates Them — Volumetric, Protocol & Application-Layer student learning map A visual study map for DDoS Attack Types & How Radware Mitigates Them — Volumetric, Protocol & Application-Layer showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP DDoS Attack Types & How Radware Mitigates Them —... Radware · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① The three DDoS families — by... 4. Practice ② Volumetric & amplification —... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most engineers think… Most people picture DDoS as 'a huge flood of traffic that fills your internet pipe'. That mental model only describes one of three families and will trip you up in an interview and in the SOC. DDoS attacks fall into three families that hit different layers : volumetric floods saturate bandwidth at L3/4, protocol attacks exhaust stateful resources like connection tables, and application-layer (L7) attacks drain web and app server resources with seemingly legitimate requests at tiny bandwidth. Because no single defence covers all three, modern attacks are usually multi-vector . Radware DefensePro and Cloud DDoS Protection answer each layer with a different mechanism — and understanding that mapping is exactly what lets you read an attack, pick the right control, and stop a zero-day flood in seconds without blocking real users. ## ① The three DDoS families — by layer and by target The single most important idea: DDoS is not one attack. It is three families that hit different layers and exhaust different resources . Get the family right and the defence almost picks itself. Volumetric attacks (L3/4) aim at one thing — bandwidth saturation . UDP and ICMP floods, plus reflection/amplification, blast packets until the pipe is full. Protocol / state-exhaustion attacks (L3/4) target the state tables of servers, firewalls and load balancers — SYN floods leave half-open connections, ACK and fragment floods waste reassembly and stateful resources. Application-layer (L7) attacks target web and app server logic with legitimate-looking requests — HTTP floods, Slowloris and DNS query floods. The interview line: because each family attacks a different resource, no single control stops all three , and real-world attacks combine vectors. You need bandwidth defence, state-exhaustion defence and L7 defence working together. Legend diagram title threat / attack panel panel border & labels how it works diagram canvas Figure 1 — Three DDoS families, three targets Each family attacks a different resource, so no single control stops all three — real attacks combine them. - Three DDoS families, three targets Volumetric (L3/4) Saturate bandwidth — UDP/ICMP floods, amplification Protocol / state (L3/4) Exhaust state tables — SYN, ACK, fragment floods Application-layer (L7) Drain app resources — HTTP flood, Slowloris, DNS query Each family attacks a different resource, so no single control stops all three — real attacks combine them. Quick check · Q1 of 10 · Understand Why does no single control stop every DDoS attack? a) Because each family attacks a different resource — bandwidth, state tables or app logic b) Because all attacks are encrypted c) Because firewalls are always off d) Because every attack is volumetric Correct: a. Volumetric floods saturate bandwidth, protocol attacks exhaust state tables, and L7 attacks drain app resources. Different targets need different controls, which is why real attacks are multi-vector. 👉 So far: DDoS has three families — volumetric (saturate bandwidth), protocol (exhaust state tables) and application-layer (drain app resources). No single control stops all three, so real attacks are multi-vector. ## ② Volumetric & amplification — small requests, terabit floods Volumetric attacks win by sheer volume. Plain UDP and ICMP floods simply send huge packet rates to exhaust pipe capacity. The frightening multiplier is reflection/amplification : the attacker spoofs the victim's source IP and queries open servers, which then send oversized replies to the target. ### The amplification factors you must name DNS amplification runs about 10–50x . NTP MONLIST (CVE-2013-5211) returns the last 600 client IPs for roughly 556.9x . memcached on UDP port 11211 is the monster — a 203-byte request can trigger a ~100 MB reply, around 50,000x , which powered the 2018 GitHub ~1.3 Tbps attack. Radware answer: behavioral detection flags volume and rate anomalies, DefensePro auto-generates a real-time signature characterising the flood, and rate limiting kicks in — while volumes beyond the local pipe divert to Radware cloud scrubbing centers. Figure 2 — How reflection & amplification works The attacker spoofs the victim's IP so open servers send oversized replies to the target — small request, huge flood. How reflection & amplification works Spoof IP fake victim source IP Small query to open DNS/NTP/memcached Amplify DNS 50x · NTP 556x · 50000x Flood target oversized replies hit victim The attacker spoofs the victim's IP so open servers send oversized replies to the target — small request, huge flood. 📈 Amplification factor tap to flip Ratio of reflected response size to attacker request size — about 50x for DNS, 556x for NTP MONLIST and ~50,000x for memcached on UDP 11211. 🔗 Half-open connection tap to flip A TCP session stuck after SYN/SYN-ACK with no final ACK. SYN floods pile these up to exhaust the server's backlog; SYN cookies defeat them. 🧠 Behavioral-DoS (BDoS) tap to flip Radware's baseline-learning engine that detects unknown/zero-day floods and auto-generates a real-time signature — often in under ten seconds. 🌊 Web DDoS Tsunami tap to flip An encrypted, randomised HTTPS flood designed to evade rate-based L7 defences — blocked by behavioral TLS fingerprinting without decryption. Reflection always spoofs the victim's IP The whole trick of amplification is that the attacker forges the victim's source IP, so open DNS/NTP/memcached servers send their oversized replies straight to the target. In an interview, say 'spoofed victim IP plus a high amplification factor' and you have nailed it. Quick check · Q2 of 10 · Remember memcached amplification abuses which UDP port, and why is it so dangerous? a) Port 53, because DNS is unauthenticated b) Port 123, because NTP returns 600 IPs c) Port 11211, because a tiny request triggers a ~50,000x reply d) Port 443, because TLS hides the flood Correct: c. memcached listens on UDP 11211 by default. A ~203-byte spoofed request can trigger a ~100 MB reply (~50,000x), which fueled the 2018 GitHub ~1.3 Tbps attack. 👉 So far: Volumetric = sheer volume. Reflection/amplification spoofs the victim's IP: DNS ~10–50x, NTP MONLIST ~556x, memcached on UDP 11211 ~50,000x — which powered the 2018 ~1.3 Tbps GitHub attack. ## ③ Protocol & application-layer — bandwidth-light, resource-deadly These families barely move the bandwidth needle, yet they take services down. Protocol / state-exhaustion attacks abuse how stateful devices track connections. A SYN flood sends spoofed TCP SYNs; the server allocates a half-open connection for each and waits for a final ACK that never comes, exhausting the backlog. ACK floods and fragmented-packet attacks waste reassembly and stateful resources on firewalls and load balancers. ### Application-layer (L7) HTTP/HTTPS floods send valid-looking GET/POST requests to overwhelm app and database tiers. Web DDoS 'Tsunami' floods use encrypted, randomised requests to evade rate rules. Slowloris opens many connections and sends partial headers slowly to tie up every server thread at very low bandwidth — volume alarms stay quiet while threads silently fill. DNS query floods swamp DNS servers with unique lookups. The interview line: watch the right meter . If bandwidth is flat but connections or request anomalies spike, you are looking at protocol or L7 — not a volumetric flood. Figure 3 — Protocol vs application-layer attacks Both are bandwidth-light but resource-deadly — read the right meter to tell them apart. Protocol vs application-layer attacks Protocol (L3/4) SYN flood — half-open backlog ACK & fragment floods Exhausts state tables Spoofed packets, low payload Application-layer (L7) HTTP/HTTPS floods Web DDoS Tsunami (encrypted) Slowloris — slow partial headers DNS query floods Both are bandwidth-light but resource-deadly — read the right meter to tell them apart. 'All DDoS is a bandwidth flood' under-read If you only watch bits-per-second you will miss SYN floods and Slowloris entirely — they barely register on bandwidth. Always check connection-table and request-rate anomalies too, or you will declare 'all clear' while the service is down. Quick check · Q3 of 10 · Apply A web server shows thousands of open connections, near-zero bandwidth and a very low request rate. Which attack is this? a) A UDP amplification flood b) An ICMP volumetric flood c) A DNS reflection attack d) A Slowloris low-and-slow L7 attack Correct: d. Slowloris holds many connections open with slow partial HTTP requests, tying up threads at tiny bandwidth. Volume alarms stay flat while the connection table fills — exactly this signature. 👉 So far: Protocol (SYN/ACK/fragment) exhausts state tables; L7 (HTTP floods, Web DDoS Tsunami, Slowloris, DNS query) drains app resources. Both are bandwidth-light — watch connections and request anomalies, not just bits-per-second. ## ④ How Radware mitigates each layer — the mechanism per family Radware maps a specific mechanism to each family. Volumetric: behavioral baselining flags rate/volume deviations, DefensePro synthesises a real-time signature (often under 10 seconds ) and applies rate limiting; overflow diverts to cloud scrubbing. Protocol: SYN Protection with SYN cookies answers SYNs statelessly and only allocates state after a completed handshake. Application-layer: L7 behavioral analysis profiles normal request patterns, challenge/authentication weeds out bots, and behavioral TLS/HTTPS fingerprinting blocks encrypted floods without decryption ; per-source connection and request limits kill slow-and-low attacks like Slowloris. ### Known vs zero-day The cross-cutting split: 'DoS Shield' handles known floods via signatures, while Behavioral-DoS (BDoS) handles unknown/zero-day floods — it learns a baseline, detects the anomaly and synthesises a fresh signature automatically, minimising false positives on legitimate traffic. Figure 4 — One Radware engine, a mechanism per family DefensePro and Cloud DDoS apply a tailored control to each attack family from one behavioral core. One Radware engine, a mechanism per family DefensePro + Cloud DDoS Real-time signatures Rate limiting SYN cookies / SYN Protection L7 challenge / auth TLS fingerprinting Cloud scrubbing DefensePro and Cloud DDoS apply a tailored control to each attack family from one behavioral core. Figure 5 — Behavioral-DoS — zero-day flood to signature BDoS learns a baseline, detects the anomaly and synthesises a real-time signature automatically — often in under ten seconds. Behavioral-DoS — zero-day flood to signature Baseline learn normal traffic Detect rate/behavior anomaly Signature auto-generated, ### What's next? Got the attack families? Next, go deep on Radware Behavioral-DoS internals — how it baselines normal traffic, detects rate and rate-invariant anomalies, and synthesises a real-time signature in under ten seconds without flooding the SOC with false positives. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt