Account confirmers, Anti-spam team, Confirmed users, Bureaucrats and Sysops emeriti
4,925
edits
Inform/Distributed Denial of Service: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
No edit summary |
||
| Line 1: | Line 1: | ||
{{draft}} | {{draft}} | ||
===What is a DDOS?=== | |||
A '''distributed denial of service attack (DDoS)''' occurs when multiple systems distributed around the Internet send a large volume of bogus requests to a targeted system or systems, usually one or more web servers. When a server is overloaded with connections or if its bandwidth is saturated, new connections can no longer be accepted or old ones maintained, thereby denying service to the website's legitimate visitors. It's like having a discussion in a small group, when a large mob surrounds you and they all begin shouting loudly. The real communication ceases, as it's lost in the noise. | |||
===Explanation=== | |||
[[File:Ddos-before.png|400px|thumb|right|Normal operation]] | [[File:Ddos-before.png|400px|thumb|right|Normal operation]] | ||
[[File:Ddos-after.png|400px|thumb|right|During DDoS attack]] | [[File:Ddos-after.png|400px|thumb|right|During DDoS attack]] | ||
A DDoS attack is distributed, which means the attacker has control of a large number of systems around the Internet with which to attack. These would almost always be systems which have been compromised by [[Malware|malware]] and thereby probably also been joined to a [[Botnet|botnet]] for control and coordination - so they are used without the consent of their owners. Attacks from a single or a small number of sources can be easily blocked by the target or their [[ISP|ISP]]. When an attack comes from many, many different [[IP Address|IP addresses]], it is hard to distinguish the malicious traffic from legitimate traffic, and so blocks run the risk of excluding real visitors. | A DDoS attack is distributed, which means the attacker has control of a large number of systems around the Internet with which to attack. These would almost always be systems which have been compromised by [[Malware|malware]] and thereby probably also been joined to a [[Botnet|botnet]] for control and coordination - so they are used without the consent of their owners. Attacks from a single or a small number of sources can be easily blocked by the target or their [[ISP|ISP]]. When an attack comes from many, many different [[IP Address|IP addresses]], it is hard to distinguish the malicious traffic from legitimate traffic, and so blocks run the risk of excluding real visitors. | ||