Week 7 Tutorial – Denial of Service (DoS) Attacks
Introduction
Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks aim to disrupt the
availability of systems by overwhelming them with malicious traffic or exhausting system
resources. This tutorial explores a real-world DDoS incident, reviews common DoS tools, and
demonstrates defensive monitoring and mitigation techniques using Kali Linux.
Task 1: Researching a DoS/DDoS Incident
Incident Overview
A well-documented Distributed Denial of Service (DDoS) attack targeted GitHub, a widely used
software development and hosting platform. The attack involved extremely large volumes of
traffic designed to overwhelm GitHub’s infrastructure and disrupt access for users worldwide.
Target Organization or Service
Target: GitHub (online code hosting and collaboration service)
Type of Attack Used
Attack Type: Volumetric Distributed Denial of Service (DDoS) attack
The attack relied on flooding GitHub’s servers with massive amounts of traffic to exhaust
network bandwidth and server capacity.
Impact on Users and Business
Temporary service outages and performance degradation
Developers experienced delays in accessing repositories and pushing code
Potential business impact included productivity loss and reputational risk, although
mitigation systems limited long-term damage
Summary
This incident demonstrates that even large, well-protected organizations can be targeted by
DDoS attacks. It highlights the importance of continuous traffic monitoring and layered defense
mechanisms to ensure service availability.
Task 2: Exploring DoS Tools
Several tools are commonly associated with DoS and DDoS attacks. Although these tools may
have legitimate testing purposes, they are often misused by attackers.
LOIC (Low Orbit Ion Cannon)
Purpose: Originally developed as a network stress-testing tool
Attack Method: Traffic flooding using TCP, UDP, or HTTP requests
Detection and Mitigation:
Sudden spikes in traffic can be detected using packet analysis tools such as tcpdump.
Firewalls and rate limiting help reduce the effectiveness of flooding attacks.
HOIC (High Orbit Ion Cannon)
Purpose: An advanced version of LOIC with greater flexibility
Attack Method: HTTP flood attacks targeting web servers
Detection and Mitigation:
Web Application Firewalls (WAFs), request rate limiting, and behavioral traffic analysis
are effective countermeasures.
Hping3
Purpose: Packet crafting and network testing tool
Attack Method: SYN floods and malformed packet floods at the transport layer
Detection and Mitigation:
Intrusion Detection Systems (IDS), SYN cookies, and firewall rules help identify and
block suspicious packet patterns.
Slowloris
Purpose: Designed to exhaust web server resources
Attack Method: Application-layer attack that holds multiple HTTP connections open
Detection and Mitigation:
Connection timeouts, reverse proxies, and Content Delivery Networks (CDNs) reduce the
impact of Slowloris-style attacks.
Tool Comparison Summary
LOIC and HOIC: High-volume flooding attacks
Hping3: Low-level packet-based attacks
Slowloris: Application-layer resource exhaustion
Task 3: Mitigation Strategies and Practical Observation
Network Monitoring Evidence (Kali Linux)
Using Kali Linux, basic network connectivity and traffic monitoring were verified and observed:
The ip a command confirmed that the eth0 network interface was active with a valid IP
address.
The ping -c 4 [Link] command demonstrated normal network connectivity with 0%
packet loss, indicating no active DoS condition.
The tcpdump -i eth0 command captured live network packets, including legitimate traffic
such as NTP communication with Cloudflare servers.
These observations show how packet capture tools can be used to detect abnormal traffic
volumes or suspicious patterns associated with DoS attacks.
Mitigation Strategy 1: Firewalls and Intrusion Detection Systems (IDS)
Firewalls and IDS monitor incoming traffic and identify abnormal patterns such as excessive
connection attempts. When suspicious behavior is detected, traffic can be blocked or alerts
generated, reducing the effectiveness of DoS attacks.
Mitigation Strategy 2: Rate Limiting and Traffic Filtering
Rate limiting restricts how many requests a client can make within a given time period. This
prevents attackers from overwhelming servers with excessive requests and helps maintain
service availability for legitimate users.
Mitigation Strategy 3: Content Delivery Networks (CDNs)
CDNs distribute traffic across multiple geographically dispersed servers. This absorbs large
volumes of traffic at the network edge and prevents the origin server from being directly
overwhelmed during a DDoS attack.
Mitigation Strategy 4: Cloud-Based DDoS Protection
Cloud-based DDoS protection services provide large-scale traffic scrubbing and automated
detection. These services are particularly effective against high-volume volumetric attacks.
Conclusion
Denial of Service attacks remain a significant threat to online services. The GitHub DDoS
incident demonstrates the potential impact of such attacks on availability and business
operations. By understanding common attack tools and implementing layered defenses—
including monitoring, firewalls, rate limiting, CDNs, and cloud-based protection—organizations
can significantly reduce the risk and impact of DoS and DDoS attacks.