Where Is the Flood Coming From?

About this interactive

The lesson explains why an attacker distributes an attack and the two main ways they do it, and a defender reads the attack back from where the traffic comes from. A single-source denial of service comes from one machine; block that one address and it stops. A botnet DDoS uses command and control: many compromised, real devices around the world receive an order and all attack at once, so the sources are a vast spread of genuine but hijacked hosts, and blocking any one does little. A reflected DDoS is different again: the attacker sends requests to ordinary, uncompromised servers with the victim's address spoofed as the sender, so the servers' replies all converge on the victim. There the sources are innocent third parties that never meant to take part. One host, many compromised hosts, or many innocent reflectors: that is the distinction, and it decides how the defender responds.

What you'll learn

Distinguish a single-source denial of service from a distributed attack by the pattern of its source addresses
Tell a botnet command-and-control DDoS from a reflected DDoS by whether the sources are compromised hosts or innocent third-party servers

Aligned to

CompTIA Security+

2.4 Given a scenario, analyze indicators of malicious activity.

Key terms

Distributed Denial of Service: An attack that uses multiple systems to flood a target with traffic, making it unavailable to legitimate users.
Botnet: A network of compromised computers controlled by an attacker, often used to conduct distributed attacks.
Command and Control: Command and Control refers to the infrastructure and communication channels used by attackers to issue instructions to and receive data from compromised systems, enabling persistent access and coordinated attack operations.
Reflected Attack: A DDoS technique where an attacker spoofs a victim's IP address to redirect responses from third-party machines toward the target, amplifying attack traffic without direct control of those machines.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →