DoS Attack Type Classifier

The three-tier DoS taxonomy is not a naming exercise. It exists because each tier is stopped by a different control at a different place in the network, and picking the wrong tier means buying the wrong defence. Volumetric attacks are absorbed upstream, at a scrubbing centre or by the transit provider, because by the time the traffic reaches your firewall the circuit is already full and nothing you own can help. Protocol attacks are absorbed at the edge device, by SYN cookies, connection rate limits and a firewall state table large enough to survive the burst. Application-layer attacks are absorbed at layer 7, by a WAF, request rate limiting and caching, because the packets themselves are perfectly legal and only their intent is hostile. Sorting all twelve items comes down to one question: which resource runs out first? Volumetric attacks exhaust bandwidth — the pipe itself. The UDP flood at millions of packets per second and the ICMP ping flood consuming ingress bandwidth are the unadorned version of the idea: send more bits than the link can carry and the link stops carrying anyone's. The DNS amplification and NTP monlist items are the same idea with better economics, and they are the reason objective three exists. An amplification attack sends a small spoofed request to a third party — an open DNS resolver, an NTP server still answering monlist — that replies with a far larger response aimed at the victim, because the source address was forged. The amplification factor is simply the ratio of reply size to request size, and at 100x an attacker with a modest uplink produces a flood no single machine could generate directly. It is tempting to file these under Protocol, since a protocol feature is clearly being abused, and that instinct is what this activity is built to correct. Ask what actually breaks the victim. The victim is not running the open resolver, is not parsing monlist, and has no protocol state involved at all — it is simply receiving more traffic than its circuit can hold. DNS and NTP are the amplifier, not the target. Volume is the weapon. Protocol attacks exhaust connection state rather than bandwidth, and they are notable for how little traffic they need. The SYN flood is the canonical case: the attacker sends TCP SYN packets, the server allocates a table entry and replies SYN-ACK, and the final ACK never comes. Each half-open connection costs the attacker one small packet and costs the server a slot in a finite table, so the table fills long before the link does. That asymmetry is the tell for the whole tier. The LAND attack sends a SYN whose source and destination address are both the victim's, so the machine answers itself in a loop that older stacks could not escape. The Teardrop attack sends IP fragments whose offsets deliberately overlap, so that reassembly produces a nonsensical length and crashes the buffer — a close cousin of the Ping of Death, which achieves the same crash with an oversized packet. In none of these three is the pipe full; the connection table, the TCP state machine or the reassembly buffer is what gives out. Application-layer attacks exhaust the application's own processing, and their defining property is that every request is legitimate. The HTTP flood aimed at a search endpoint is the clearest example of why traffic volume is the wrong measure here: a search query is cheap to send and expensive to answer, so a few thousand well-chosen GETs can pin a database while barely registering on a bandwidth graph. The HTTP POST flood works the same lever with large form submissions that force server-side parsing and validation. Slowloris inverts the tactic entirely and is worth studying for that reason — instead of sending requests quickly it sends them as slowly as possible, opening many connections and dribbling out partial headers so that each request never completes and the server politely holds every worker thread open waiting for the rest. It is a denial of service achieved with almost no bandwidth at all, which is why bandwidth-based detection misses it completely. The XML bomb, or Billion Laughs, is the most extreme version of cheap request and expensive answer: a small XML document defining nested entities that each expand into several of the entity below, so a few kilobytes on the wire become gigabytes in memory when the parser dutifully expands them. The attacker spends nothing and the server spends everything. One item in this set is deliberately contentious, and it is worth knowing that before it is graded. The Smurf attack spoofs the victim's address and pings a network's broadcast address so that every host on that network replies to the victim at once. This set files it under Protocol, on the reading that the abuse is of ICMP and IP directed broadcast — protocol features behaving exactly as designed. Many references, including the CompTIA objective that pairs "amplified" and "reflected" DDoS in a single breath, would instead file it as Volumetric, on the reading that the victim experiences it as an overwhelming flood of replies and that the reflection is only the delivery mechanism. Both readings are defensible and the disagreement is genuine rather than a trick. The useful takeaway is that reflection and amplification describe how attack traffic is generated, while the volumetric, protocol and application-layer tiers describe what resource it exhausts, and the two axes are independent. An attack can be reflected and volumetric at the same time, which is precisely what makes Smurf hard to file. In an exam setting, read the answer options and let them tell you which axis the question is asking about. In an operational setting the label matters much less than the response, which for Smurf is the same either way: filter directed broadcasts inbound, and get help upstream before your circuit fills.