DoS Attack Type Identifier (Lab)
A denial-of-service attack example looks like this: a server receiving over a million TCP connection requests a second that never complete, or a link filled with DNS replies nobody asked for. This lab gives you 12 rounds of that evidence, from SYN floods and DNS amplification to Slowloris and two harmless look-alikes, and asks you to name the attack. Each answer shows the tell-tale signal, the OSI layer and the mitigation that fits. Everything runs in your browser.
Checkout times out
Online shop, 10:14 UTC. Customers say the checkout page spins and never loads. The 10 Gbps internet link is far from full.
- Inbound bandwidth
- 380 Mbps (link 10 Gbps)
- Inbound packets/sec
- 1.2 million
- TCP SYN/sec to :443
- 1.15 million
- TCP ACK/sec to :443
- 9,000
- Distinct source IPs (5 min)
- 2.4 million
- Server CPU
- 22%
- TCP98%
- UDP1.5%
- ICMP0.5%
| State | Count |
|---|---|
| SYN_RECV | 4,096 (backlog limit) |
| ESTABLISHED | 812 |
| TIME_WAIT | 2,140 |
TCP: request_sock_TCP: Possible SYN flooding on port 443. Dropping request. Check SNMP counters.
What is this?
Pick one. Keys 1 to 4 work too.
What this lab is
- 12 rounds of synthetic but realistic evidence: packet rates by protocol, source ports, SYN-to-ACK ratios, connection states, netflow rows, access logs and decoded payloads.
- Name the attack: SYN, UDP or ICMP flood, DNS, NTP or memcached amplification, SSDP reflection, HTTP GET flood, Slowloris, the historic ping of death, or a benign look-alike such as a marketing spike or a nightly backup.
- After each answer you get the reasoning, the one signal that gives it away, the OSI layer, and the mitigations that actually fit that type.
- Amplification ports and factors come from CISA alert TA14-017A and the IANA port registry. No numbers are invented.
- Score, streak, a debrief by category and a plain-text report to copy. Defensive and educational: no attack tooling, nothing uploaded.
Reference: DoS attack types at a glance
Every type in the lab, with the signal that gives it away and the first controls to reach for. Volumetric and amplification floods fill the link, so they need help upstream; protocol attacks exhaust connection state; application-layer attacks look like real requests.
| Type | Category · OSI layer | Tell-tale signal | First controls |
|---|---|---|---|
| SYN flood | Protocol · Layer 4 (transport) | A huge rate of TCP SYNs with almost no ACKs coming back, and a connection table full of half-open (SYN_RECV) entries. Bandwidth is often modest. | Turn on SYN cookies so a half-open connection costs the server no state (RFC 4987). Put a SYN proxy in front (load balancer, firewall or scrubbing service) so only completed handshakes reach the server. |
| UDP flood | Volumetric · Layers 3 and 4 (network and transport) | A high UDP packet rate to random or unused destination ports from random source ports, and your host answering with ICMP "port unreachable". | Drop UDP to ports you do not serve, at your edge and preferably upstream with your provider. Rate-limit outbound ICMP unreachable replies so the host does not add to the load. |
| ICMP flood | Volumetric · Layer 3 (network) | ICMP echo requests (type 8) dominate the packet rate, and your hosts spend outbound bandwidth sending echo replies (type 0). | Rate-limit ICMP echo requests at the edge and ask your provider to do the same upstream. Do not block all ICMP: path MTU discovery depends on some ICMP messages, and blocking them breaks real connections. |
| DNS amplification | Amplification / reflection · Layers 3 and 4 (volumetric), abusing DNS over UDP | Large, unsolicited DNS responses arriving from UDP source port 53 from many different resolvers, with no matching queries from your side. | Ask your provider or scrubbing service to filter UDP source port 53 toward hosts that are not DNS clients. Stateful UDP inspection at the border drops responses that match no request (CISA TA14-017A). |
| NTP amplification | Amplification / reflection · Layers 3 and 4 (volumetric), abusing NTP over UDP | Bursts of large UDP packets from source port 123 (NTP monlist replies, mode 7) from many NTP servers you never queried. | Filter UDP source port 123 upstream toward hosts that do not sync time from the internet. If you run ntpd: upgrade to 4.2.7 or later, or add "noquery" to the "restrict default" line (CISA TA14-013A, CVE-2013-5211), so your server cannot be a reflector. |
| Memcached amplification | Amplification / reflection · Layers 3 and 4 (volumetric), abusing memcached over UDP | An enormous flood of UDP from source port 11211, mostly IP fragments, from a modest number of servers in hosting networks. | Never expose memcached to the internet: bind it to internal interfaces and firewall port 11211. memcached 1.5.6 and later ship with UDP off by default. Keep it off. |
| SSDP reflection | Amplification / reflection · Layers 3 and 4 (volumetric), abusing SSDP (UPnP) over UDP | UDP from source port 1900 carrying text that looks like "HTTP/1.1 200 OK" with ST, USN and LOCATION headers, from home routers and IoT devices. | Filter UDP source port 1900 upstream. Block SSDP/UPnP (UDP 1900) at your own internet edge so your devices cannot be used as reflectors. |
| HTTP GET flood | Application layer · Layer 7 (application) | Handshakes complete and the HTTP is valid, but the request rate is far above normal and concentrated on one expensive path, often with cache-busting parameters and one client fingerprint. Bandwidth can look normal. | WAF rules and per-client rate limits on the targeted path. Serve and cache through a CDN; ignore or reject query parameters the application does not use. |
| Slowloris / slow-read | Application layer · Layer 7 (application) | Very little bandwidth from very few clients, yet every server worker is busy: connections stay open for minutes with incomplete headers (Slowloris) or a tiny TCP read window (slow-read). | Set header and body read timeouts and a minimum data rate per connection. Cap concurrent connections per client IP. |
| Ping of death (historic) | Malformed packet · Layer 3 (network) | A handful of fragmented ICMP echo packets whose fragments reassemble to more than 65,535 bytes, the IPv4 maximum, and a device that crashes or reboots. It is about one bad packet, not volume. | Patch or replace the stack. Mainstream operating systems were fixed after the 1996 CERT/CC advisory; treat any device still affected as end-of-life. Drop malformed and oversized fragment chains at the edge. |
| Flash crowd (not an attack) | Not an attack · Not applicable | The spike lines up with a known event, sessions load pages and their images and scripts, browsers and referrers vary, and people buy or sign up. | Do not block. Scale out, cache, and use a CDN or a queue page. Agree launch dates with marketing so operations knows when a spike is coming. |
| Scheduled backup job (not an attack) | Not an attack · Not applicable | One or a few long internal flows at the same time every night, with normal handshakes and ACKs, matching a job in the change calendar. | Confirm with the job owner and the schedule, then record it as the baseline. Use QoS or move the window if it competes with production traffic. |
Amplification ports and factors (CISA TA14-017A)
The bandwidth amplification factor is how many bytes of reply the reflector sends for each byte of request. Figures are from CISA’s alert TA14-017A, UDP-Based Amplification Attacks (last revised December 2019), which lists 19 protocols; ports are from the IANA service name and port number registry.
| Attack | Abused port | Amplification factor (CISA) |
|---|---|---|
| DNS amplification | UDP 53 | 28 to 54 |
| NTP amplification | UDP 123 | 556.9 |
| Memcached amplification | UDP 11211 | 10,000 to 51,000 |
| SSDP reflection | UDP 1900 | 30.8 |
CISA’s defensive advice in the same alert: stateful UDP inspection at the border, a remotely triggered blackhole arranged with your upstream provider, an up-to-date list of provider emergency contacts, and ingress filtering of spoofed packets under BCP 38 (RFC 2827) and BCP 84. If you run DNS, NTP, memcached or UPnP devices, make sure they cannot answer the whole internet. For DNS that means no open recursion and response rate limiting on authoritative servers (CISA TA13-088A); for NTP, ntpd 4.2.7 or later or the noquery restriction (CISA TA14-013A).
How to read DoS evidence
- Is the link full? If yes, the answer is upstream: scrubbing, a CDN or provider filtering. Your firewall cannot drop what never reaches it.
- Which source port? A flood from one well-known UDP service port (53, 123, 1900, 11211) that you never queried is reflection.
- Do handshakes complete? Many SYNs and few ACKs means a protocol attack; complete handshakes with too many requests means layer 7.
- Bandwidth low but the service is down? Look at connection age and bytes per connection: Slowloris holds workers with almost no traffic.
- Does it match a known event? Sale emails, launches and backups produce spikes that are not attacks. Check before you block real customers.
All evidence in the lab is synthetic. IP addresses are from the documentation ranges reserved by RFC 5737. For the background, read types of DoS attacks explained and is a DDoS attack illegal?
Frequently asked questions
What is an example of a denial of service attack?
A SYN flood is the classic example: an attacker sends a huge number of TCP connection requests (SYNs) from spoofed addresses and never completes the handshake, so the server's table of half-open connections fills and real users cannot connect. Other common examples are UDP and ICMP floods that fill the network link, DNS or NTP amplification where third-party servers are tricked into sending large replies to the victim, and HTTP GET floods that hammer an expensive page such as search. The lab above shows twelve examples as the evidence an analyst would actually see.
Is DDoS illegal?
Launching a DDoS attack against a system you do not own or have explicit written permission to test is a crime in most jurisdictions, for example under the US Computer Fraud and Abuse Act and the UK Computer Misuse Act. Paying a "booter" or "stresser" service to do it is no different. Load-testing your own systems, or a client's under an agreed scope, is lawful. This lab uses synthetic evidence only and teaches recognition and defence. This is general information, not legal advice.
How can you tell a DDoS attack from a normal traffic spike?
Look at behaviour, not just volume. A flash crowd lines up with a known event such as a sale email, visitors browse several pages, load images and scripts, use varied browsers and come from the ISPs your customers use, and some of them buy. Attack traffic tends to hit one path or one port, skips assets, repeats one client fingerprint, comes from hosting networks or spoofed addresses, and never converts. At the network layer, a nightly backup is one long internal flow at the same time every night; an attack is many sources aimed at one target.
What is an amplification attack and which ports are abused?
The attacker sends small requests to public servers with the victim's address forged as the source, and the servers send much larger replies to the victim. CISA alert TA14-017A lists bandwidth amplification factors for 19 UDP protocols, including DNS (UDP 53) at 28 to 54, NTP (UDP 123) at 556.9, SSDP (UDP 1900) at 30.8 and memcached (port 11211) at 10,000 to 51,000. The tell is a flood of replies from one service port that your hosts never asked for.
What is the difference between a SYN flood and an HTTP flood?
A SYN flood works at layer 4: the handshake never completes, so you see a very high SYN-to-ACK ratio and a backlog full of half-open connections, while bandwidth and CPU can look normal. An HTTP flood works at layer 7: handshakes complete and requests are valid, but there are far too many of them, usually aimed at one expensive path. SYN cookies and SYN proxies stop the first; WAF rules, rate limits and caching stop the second.
How do you stop a DoS attack?
Match the control to the type. SYN cookies or a SYN proxy for SYN floods. Upstream scrubbing, a CDN and provider filtering for volumetric and amplification floods, because no on-premises firewall can drop traffic that has already filled the link. WAF rules, rate limits and caching for HTTP floods. Timeouts, minimum data rates and per-IP connection caps for Slowloris. Do not run open reflectors yourself (open DNS recursion, NTP monlist, internet-facing memcached or UPnP), and networks should apply BCP 38 ingress filtering so spoofed traffic cannot leave them.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.