The 10 Most Common DDoS Attack Types

Distributed Denial-of-Service (DDoS) attacks are one of the oldest cybersecurity threats and have been around since the early days of the internet. Although there are many DDoS attack types (which we’ll analyze in a bit), they all follow a similar structure: malicious forces completely shut down email, websites, bank accounts, or other online services by flooding their hosts with heavy traffic. Overwhelmed by the requests, the system will either crash or begin limiting access to all users, even those who are permitted and registered to use it.¹ While administrators and security professionals try to get back in, the attackers have free reign of all the host’s information, security controls, and functions and are free to do with it what they please.

Initially just a mild annoyance instigated by bored individuals to take down servers, DDoS attacks have evolved into complex, automated programs targeting high-profile corporations and government agencies. A recent example is UK citizen Alex Bessell, also known as the Skype DDoSer, who was arrested in 2018 for launching DDoS attacks on Google, Nintendo and Skype.²

Most DDoS attacks fit into one of three categories: protocol attacks, application layer attacks, or volume-based attacks. There are several different DDoS attack types within each category, some fully automated and some semi-automated. However, the underlying intention remains the same across all of the tactics: to temporarily disrupt or entirely disable the operations of a server or computer network. In this list, we outline and describe the 10 most common types of DDoS attacks.³

A packet flood is the original and simplest form of DDoS attack types, exploiting basic network traffic protocols to flood a server with millions of redundant requests. Some of the different protocols used in packet flood attacks include SYN, UDP and ICMP, amongst others. Although simple, packet floods remain one of the most used and best DDoS methods available.⁴

Zero-day attackers exploit errors in code that haven't been discovered or patched by the developers yet. Hackers use these gaps in security to infiltrate systems and launch DDoS attacks.⁵ Zero-day exploits are not restricted to DDoS attacks. Apple recently patched a zero-day vulnerability in its iOS mobile operating system that was likely being used to unlock stolen phones.⁶

CharGEN is an old, exploitable protocol often found on internet-enabled printers and copiers that can't be patched. Via the CharGEN attack, hackers can access a device and flood the network with UDP requests on port 19.⁷

Much like a CharGEN attack, protocol amplification attacks exploit devices using common public protocols like NTP or SNMP. They spoof an IP address to gain access and, once inside, flood the system with amplified UDP or SYN requests.⁸

DDoS amplification attacks can also be performed using lesser-known protocols like SSDP, SNMPv2, NetBIOS, QOTD and Memcached. Cybersecurity company CloudFlare recently found that an amplified memcached attack using only 15 bytes could elicit a 750KB response—an amplification of 51,200 times.⁹

Slowloris is a specialized DDoS type that opens multiple connections to a web server by sending partial HTTP requests. Eventually, with too many connections open, the web server can no longer serve legitimate clients and goes offline.¹⁰

A Ping of Death scenario exploits a function used by network systems that break down large IP packets into small fragments for Ethernet transmission. By manipulating the size of a fragment, it can create a situation where a reassembled IP packet is larger than the maximum allowed length, causing memory overflow and dropping legitimate packets.¹¹

Bad code found in applications that run on web servers can be exploited to take down the entire web server. The popular blogging site WordPress is an example of a site that could be exploited to achieve this. Two types of application-level attacks include HTTP flooding and BGP hijacking.¹²

By setting the value of an IPv4 header to zero, hackers can get around security systems that scan Transport Protocols. Send enough of these IP Null packets to a server and it will eventually overload and reboot.¹³

Some hackers make use of multiple different DDoS attack types at the same time to increase the severity of the attack. This is often used when attempting to access a highly secure system where a standard DDoS attack would be detected quickly.¹⁴

Almost all modern cybersecurity systems will quickly detect and take down a standard DDoS attack, so hackers have developed advanced methods to trick security systems. These involve the initiation of multiple fake ACK (acknowledge) sessions within a TCP communication process, followed by RST (reset) and FIN (finish) sessions that generate low TCP-SYN traffic. When used concurrently and en masse, these sessions eventually exhaust the resources of a security network and take the system down.¹⁵

The above are just a few examples of the many DDoS attack types that hackers are constantly improving upon daily. As more and more companies move the majority of their operations online, cybersecurity is quickly becoming the most critical part of a business.

Cyberattacks are on the rise in 2022 and don't look like they will abate anytime soon. Some estimates suggest there will be as many as 35 million unfilled cybersecurity positions by 2025.¹⁶ If you want to get involved in this burgeoning industry and help fend off the growing threat of hackers, consider an online Master of Science in Cybersecurity from the Katz School of Science and Health.

Our convenient online course can be completed from home in your own time, leaving you free to attend to any existing family or work commitments. Our online MS in Cybersecurity focuses on both the technical and business side of cybersecurity, ensuring you're ready for rapid career growth within the industry. Get started by talking with an Admissions Advisor or starting your application today.