Volumetric denial-of-service attack

As explained in Secure APIs

A volumetric denial-of-service attack overwhelms a target with a very large volume of network traffic or requests.

A volumetric denial-of-service attack overwhelms a service with millions of network requests or packets, consuming resources until legitimate users cannot receive responses. It may target the application layer, but more commonly targets layers 3–6 of the OSI model. section 9.3

Common forms include:

• ICMP, or ping, floods send packets without waiting for replies, consuming server resources. section 9.3
• SYN and UDP floods, DNS and UDP amplification attacks, and IP fragmentation attacks overwhelm network services in different ways. section 9.3
• Application-layer flooding can send millions of HTTP requests; unrestricted resource retrieval, such as requesting millions of products, creates a related failure mode. section 9.3

Figure 9.14 A common DoS attack is ping flood. The goal of this attack is to overwhelm the server with an unlimited number of ping requests until it can no longer respond to requests from legitimate users.

Use the ping-flood illustration to visualize how unlimited requests can prevent legitimate users from receiving responses. section 9.3

How Secure APIs covers it

How deep it goes

Defines resource exhaustion, distinguishes application and network layers, and lists attack types without detailing broader defenses.

Examples

Uses unrestricted product retrieval, HTTP request floods, and ping floods to illustrate overload.

What you can do after

Evaluate whether traffic floods can exhaust resources and identify ICMP disabling as a stated ping-flood prevention measure.

How it connects

Connects denial-of-service attacks with the OSI model, application-layer attacks, ICMP floods, amplification attacks, and IP fragmentation.

liveBookmanning.com

Read Secure APIs on liveBook Get the book at manning.com

Related concepts

• denial-of-service attackkind of · A denial-of-service attack is an attempt to make a system or service unavailable or degrade its ability to serve legitimate users by exhausting or disrupting its resources.

This explainer was generated by Manning's knowledge graph from the text of Secure APIs. The section links point to the parts of the book it draws on.