A denial-of-service (DoS) attack maliciously disrupts a system, service, or network until it becomes unusable. It primarily targets availability in the CIA triad. section 11.2.1
Common mechanisms include:
- SYN floods send TCP SYN messages without completing the final ACK, filling the target's table with half-open connections. section 11.2.1
- DDoS attacks distribute the attack across malware-infected devices in a botnet rather than using one attacking device. section 11.2.1
- Reflection and amplification attacks use spoofed requests to third-party reflectors, causing disproportionately large responses to overwhelm the target. section 11.6
- RF jamming floods 802.11 frequency bands, preventing legitimate wireless communication; physical security is the stated preventative measure. section 20.1.1
DoS can also arise while security features inspect traffic. DHCP Snooping and Dynamic ARP Inspection can consume switch CPU when attackers send excessive DHCP or ARP messages. section 13.2.3 section 14.3
Limiting DHCP Snooping traffic
On an untrusted Cisco switch port, configure `ip dhcp snooping limit rate 1`. If the port exceeds one packet per second, the switch error-disables it, preventing further DHCP messages. section 13.2.3
Figure 11.2 A TCP SYN flood attack—an example of a DoS attack. (1) The target is flooded with SYN messages and (2) replies with SYN-ACK messages. (3) The half-open TCP connections prevent the target from accepting legitimate TCP connections.
Trace the SYN flood sequence from incoming SYN messages through SYN-ACK replies to exhausted half-open TCP connections. section 11.2.1
