What is a DDoS attack?

A DDoS attack (Distributed Denial of Service) floods a server, a website or an entire network with so many requests that legitimate users can no longer get through. It is called distributed because the traffic does not come from one single machine, but from hundreds up to hundreds of thousands of hijacked devices at the same time, a so-called botnet.

How a DDoS attack unfolds

Everything starts with the botnet. Attackers infect other people's computers, routers, cameras or poorly secured servers with malware and then control them remotely from one central point. The owners usually never notice a thing. On command, all of those devices send requests to the same target simultaneously.

The effect hits the weakest point: either the connectivity is saturated, or the CPU and RAM of the target system are busy answering requests. In both cases the service is no longer reachable for real users. That is exactly why firewall rules on the server itself often react too late: they only take effect once the packets have already arrived over the uplink.

Common types of attack

• Volumetric attacks: UDP floods and similar patterns that simply saturate the bandwidth. Measured in Gbps.
• Protocol attacks: SYN floods and state exhaustion, which fill up the connection tables of servers, firewalls and load balancers. Measured in packets per second.
• Application layer attacks (Layer 7): HTTP floods, expensive search queries, login floods. They need very little bandwidth and look a lot like real traffic.
• Game-specific exploits: Nullping, QuietException or fake handshake floods against game servers, which abuse the connection setup instead of filling the line.

What is an amplification attack?

In an amplification attack, the attacker abuses publicly reachable third party services as amplifiers. Small requests go to open DNS, NTP or Memcached servers, with the victim's IP address entered as the sender. The replies are many times larger than the requests, and every single one of them lands on the victim.

That way a few megabits of attack traffic quickly turn into hundreds of gigabits. It is cheap for the attacker, devastating for the target, and the real source stays hidden.

Why do spoofed IP addresses work so well?

With IP spoofing, the attacker writes a false sender address into the packets. That has two effects. First, the source can no longer simply be blocked, because every request appears to come from a different, freely invented address. Second, spoofing is the precondition for amplification attacks, because otherwise the replies from the abused services would never reach the victim.

Block lists are useless against spoofed traffic. What you need is filtering that evaluates the behavior of the traffic and discards the forged packets before they reach the target.

Why is my server the one being attacked?

The motives are rarely technical. In practice we mostly see these patterns:

• Competition: another gaming network, another shop or another Discord server wants your users.
• Revenge: a banned player, a former employee or an unhappy customer.
• Extortion: a short attack as a warning shot, combined with a ransom demand.
• Vandalism: attack services can be booked for a few euros, so the inhibition threshold is correspondingly low.

For the defense the motive does not matter. What matters is that the protection is permanently active and does not have to be ordered or switched on while the attack is already running.

What really helps against DDoS attacks?

Effective protection sits in the network in front of the server, not on the server. KernelHost runs a two-stage always-on setup for exactly that: the global filtering capacity is 17 Tbps and catches volumetric attacks close to their source. Directly in front of the server in Frankfurt, the Arbor real-time filtering works with 3.2 Tbps and strips out complex, protocol-specific patterns packet by packet.

One point matters a lot here: null-routing is not used. With null-routing the attacked IP would be taken out of the network completely, the server would be offline and the attacker would have reached the goal. Instead the IP stays reachable and only the malicious packets are dropped. The protection is included in every server package, the standard plans list 3.2 Tbps, the Professional plans 17 Tbps.

Monitoring, up to date software, a small number of open ports and rate limits inside the application remain useful additions. You will find a step by step overview in the article Protecting your server against DDoS attacks. What this looks like specifically for game and voice servers is shown in Real-time DDoS protection for game servers.

Case studies: attacks we really mitigated

The following attacks hit KernelHost customer servers and were filtered completely in real time, in every case without an outage. The screenshots come from the live monitoring of the mitigation.

TeamSpeak 3 voice server, port 9987 UDP

Complex attack with several simultaneous attack patterns, more than 473.4 Gbps and more than 41.5 million packets per second. Filtered in real time, without downtime.

ARK game server, port 7777 UDP

Plain UDP flood without any complex structure, but more than 112.2 Gbps and more than 8.7 million packets per second. Filtered in real time, without downtime.

All-port attack, ports 0-65535 TCP/UDP

More than 12 different main attack patterns against all ports at once, in total more than 21.3 Gbps and more than 3.9 million packets per second. Filtered completely in real time.

Minecraft and OpenVPN, ports 25565 TCP and 1194 UDP

Combined attack with more than 16 different main attack patterns, more than 4 million packets per second and more than 8.6 Gbps. Both services stayed reachable throughout.