computational resources and results in a DoS Attack. (What is a Layer 7 DDoS attack, and how can it be prevented?)

Banana Attack—In this attack, the attacker redirects outgoing messages from the target machine back to the machine itself. As a result, the machine exhausts its own network bandwidth and becomes inaccessible to the outside network, resulting in a DoS attack.

Slowloris – In this attack, the attacker’s computer opens many connections to the target web server and tries to keep them open as long as possible. It mainly opens connections to the target web server and sends partial requests. Periodically, it sends subsequent HTTP headers but never completes those requests. As a result, the target web server keeps the maximum possible connections open and becomes inaccessible for legitimate connection requests.

NTP Amplification Attack – NTP or Network Time Protocol is a protocol used by machines connected to the internet to set their clocks accurately. These NTP Servers are publicly accessible and easily found with tools like Metasploit and NMAP. NTP Amplification Attack is an attack in which the attacker exploits these publicly available NTP Servers and sends lots of UDP packets to an NTP server and uses the IP address of a target server as the source IP address in all the UDP packets. As a result, the NTP server sends long replies to the target server that consumes all of the network bandwidth of the target server and results in a DoS attack.

HTTP Flood—An HTTP Flood Attack occurs when an attacker sends many legitimate-looking malicious HTTP GET or HTTP POST requests to a web server. These requests consume a significant amount of the server’s resources, exhausting the server and resulting in a DoS attack. (What is HTTP Flood, and how can it be prevented?)

Zero-day DoS Attack – In this type of attack, the attacker exploits software vulnerabilities for which no patch is yet released and performs the DoS attacks. This is quite a popular attack for attackers.

DNS Amplification Attack—In this attack, the attacker sends many DNS queries to a DNS server but forges the IP address of the target machine as the source IP address of all the query packets. As a result, the DNS server sends all the responses to the target machine. As DNS responses are much larger in size, they flood the target machine and consume all of its bandwidth. (What is the DNS amplification attack?)

CHARGEN Attack—CHARGEN is a character generation protocol that listens to port 19 of TCP or UDP and streams random characters until the connection is closed. For UDP, it responds to a request by sending a response with a length of up to 512 bytes. In a CHARGEN Attack, the attacker sends lots of requests with spoofed IP addresses and floods the target machine with UDP traffic at port 19, resulting in a DoS attack.

DrDoS Attack or Reflection DoS Attack – In this attack, an attacker spoofs IP addresses and sends lots of request messages to other hosts of the network. As the attacker uses the victim machine’s IP address as the source IP address of the outgoing request messages, all the other hosts send a response to the victim machine. At this point, if the attacker has a much higher bandwidth than the victim machine, the victim machine gets many responses that use up all its network bandwidth. As a result, the victim machine becomes no longer available for legitimate requests and it results in a DoS attack. (What is a DrDoS attack, and how does it work?)

SSDP Reflection Attack – SSDP or Simple Service Discovery Protocol is a protocol that enables network devices to smoothly connect with each other. It is part of the Universal Plug and Play or UPnP protocol standard. It connects devices such as computers, printers, internet gateways, Wi-Fi access points, mobile devices, cable modems, gaming consoles, etc. In the SSDP Reflection Attack, the attacker sends many falsified request messages and redirects the amplified responses to the victim machine. As a result, the victim machine gets flooded with the responses and it results in a DoS attack. The concept of this attack is very new and it first appeared in July 2014.

SNMP Attack – SNMP or Simple Network Management Protocol is a protocol that is used to manage devices with IP addresses, such as routers, servers, printers, IP video cameras, alarms, etc. These devices transmit sensor readings and other variables over the network using this protocol. In an SNMP Attack, the attacker sends falsified SNMP requests, redirects the responses to the victim machine, and floods the target machine with responses, and thus, it results in a DoS attack.

SSL Flood—When a server provides a secure connection to a client, it normally involves a large number of processing cycles from the server’s side. This type of attack exploits that scenario. The attacker requests lots of secure connections to the server, and the server loses its processing cycles to respond to the illegitimate connections and is unable to respond to the legitimate ones.

SSL Garbage Flood—In SSL Garbage Flood, the attacker sends many malformed SSL requests to the victim machine. As these SSL requests take a lot of computational resources from the SSL server, the victim machine exhausts all its resources, resulting in a DoS attack.

TCP Null Attack—In this attack, the attacker sends many IP packets to the victim machine with the IPv4 headers filled with NULL. The firewalls configured for TCP, UDP, and ICMP packets may allow these packets. As a result, an enormous number of these packets flood the victim machine and consume all of its bandwidth.

LAND Attack—It is a Local Area Network Denial attack. In this attack, the attacker sends a TCP SYN packet to initiate a TCP connection with the victim’s machine. However, the attacker uses the victim machine’s IP address as both source and destination address. As a result, the victim machine replies to itself continuously and consumes all its processing power, resulting in a DoS attack. (What is a LAND attack, and how does it work?)

Teardrop Attacks—In this attack, the attacker sends a mangled IP packet with oversized and overlapping payloads to the victim. If the victim’s machine’s operating system cannot handle it properly, the machine will crash, resulting in a DoS attack. (What is a teardrop attack, and how does it work?)

Peer-to-Peer Attacks—In this attack, the attacker gains control over the clients of a peer-to-peer file-sharing hub. He instructs the clients to disconnect from their peer-to-peer network and connect to the victim machine instead. This results in hundreds of thousands of connection requests to the victim machine. As a result, the victim machine exhausts all its computational resources, resulting in a DoS attack.

Slow Read Attack – A Slow Read Attack sends a legitimate application-layer request to the victim machine, but it reads the responses from the machine very slowly. The attacker advertises a very small number for the TCP Receive Window size and empties the victim machine’s receive buffer slowly.

Smurf Attack -In a Smurf Attack, the attacker creates many ICMP packets with the intended victim’s IP address as the source IP address and broadcasts those packets in a computer network using an IP broadcast address. As a result, computers in the network send responses to the victim machine. The victim machine gets flooded with responses, which results in a DoS attack. (What is a Smurf attack?)

Fraggle Attack – This type of attack is similar to the Smurf Attack, but instead of ICMP traffic, the attacker sends many forged UDP traffic to the victim machine.

How to protect servers from DoS and DDoS attacks?

There are a number of ways to prevent DoS attacks. It can be defended in …