DDoS attack principle, the phenomenon of being attacked by DDoS

Distributed denial of service (DDOS:Distributed Denial of Service) Attack means with the help of customers / Server technology , Combine multiple computers as an attack platform , Launch on one or more targets DoS attack , This will multiply the power of denial of service attacks . Usually , An attacker using a stolen account will DDoS The master program is installed on a computer , At a set time, the master program will communicate with a large number of agents , The agent has been installed in Internet On many computers on . When the agent receives instructions, it launches an attack . Using customers / Server technology , The master program can activate hundreds of agent runs in a few seconds .

· DDOS Attack principle

DoS There are many ways to attack , The most basic DoS An attack is to use reasonable service requests to occupy too much service resources , So that legitimate users can not get the response of the service .

DDoS The means of attack are traditional DoS A kind of attack mode based on attack . Single DoS Attacks are usually one-on-one , When attacking the target CPU Low speed 、 The performance indexes such as small memory or small network bandwidth are not high, and its effect is obvious . With the development of computer and network technology , The processing power of computers is growing rapidly , Memory is greatly increased , At the same time, there are Gigabit networks , This makes DoS The difficulty of the attack has increased - Target against malicious attack packets ” Digestion ” A lot more , For example, your attack software can send every second 3,000 An attack pack , But my host and network bandwidth can handle every second 10,000 An attack pack , In this way, the attack will have no effect .

At this time, distributed denial of service attacks （DDoS） And that's what happened . You understand. DoS Words of attack , Its principle is very simple . If we say that the processing capacity of computers and networks has increased 10 times , If attacking with an attacker no longer works , Use by attackers 10 Two attack planes attack at the same time ？ use 100 What about Taiwan ？DDoS It's using more puppet machines to launch attacks , Attack the victim on a larger scale than ever before .

The high-speed and widely connected network brings convenience to everyone , Also for the DDoS The attack created extremely favorable conditions . In the era of low-speed networks , When hackers occupy the puppet machine for attack , Always give priority to machines close to the target network , Because the number of hops passing through the router is small , The effect is good . Now, the connection between backbone nodes of telecommunications is based on G For the level of , Between big cities can reach 2.5G The connection of , This allows attacks to be launched from further places or other cities , The location of the attacker's puppet machine can be distributed in a larger range , It's more flexible to choose .

· By DDoS The phenomenon of attack

1、 There is a lot of waiting on the attacked host TCP Connect
2、 The network is full of useless packets , Source address is false
3、 Making high traffic useless data , Causing network congestion , Make the victim host unable to communicate with the outside world
4、 Take advantage of the defects in the service or transport protocol provided by the victim host , Repeatedly send specific service requests at high speed , So that the victim host cannot process all normal requests in time
5、 If it is serious, it will cause system crash