DDoS attacks and how protection works

What is a DDoS attack and why should it be taken seriously?

A DDoS (Distributed Denial of Service) attack is an attempt to take down an online service by directing a massive volume of fake traffic toward it. The main difference between this attack and a simple DoS is its distributed nature: the attacker uses thousands or millions of infected devices (a botnet) to send simultaneous requests to your server. The result is that server resources — whether bandwidth, CPU, memory, or network connections — become saturated, and real users can no longer access the service.

The important point is that a DDoS attack does not necessarily mean a breach of your server. The attacker usually isn't after stealing data; the main goal is to cause disruption, damage brand credibility, or pressure you into paying a ransom. Statistics show that the average cost of each minute of service downtime for medium-sized businesses can range from hundreds of thousands to millions of tomans — and that's just the direct cost; the cost of losing customer trust must be calculated separately.

To effectively counter a DDoS attack, you first need to know which layer of the OSI model the attack is occurring at. Because the protection solution for the network layer is completely different from that of the application layer. In the following, we will examine the three main attack layers and then move on to solutions that actually work.

Types of DDoS attacks based on the target layer

DDoS attacks can be categorized based on the OSI layer they target. Each layer has its own specific characteristics, and the method of countering it also differs.

Network and transport layer attacks (L3/L4)

These attacks target the network infrastructure, and their goal is to saturate bandwidth or fill the connection table. The most well-known types include:

• UDP Flood attack: The attacker sends a massive volume of UDP packets to random ports on the server. The server is forced to send an ICMP "port unreachable" response for each packet, which itself consumes resources.
• SYN Flood attack: The attacker sends TCP connection requests with spoofed IP addresses and never completes the Handshake phase. The half-open connection queue (SYN Queue) fills up, and new legitimate connections are rejected.
• ICMP (Ping) Flood attack: Sending a massive volume of ping packets to the server. In its engineered form, this is called a Smurf Attack, which uses the network broadcast address to amplify the attack.
• NTP Amplification attack: The attacker sends small requests to public NTP servers and spoofs the victim's IP address. The NTP server's response, which can be up to 500 times larger, is directed toward the victim.

L3/L4 attacks are typically measured by bandwidth — for example, 50 gigabits per second or 10 million packets per second. These attacks cannot be stopped with a regular firewall, because the firewall itself becomes the point of failure.

Application layer attacks (L7)

These attacks are more sophisticated, and their goal is to consume the processing resources of the web server or application. The traffic volume of these attacks is usually low (perhaps only a few thousand requests per second), but each request is very heavy:

• HTTP Flood: Sending GET or POST requests to heavy pages of the website. The attacker may use a botnet or send seemingly legitimate requests with tools like LOIC.
• Slowloris: The attacker keeps HTTP connections open and sends headers very slowly. The server waits for the request to complete and gradually loses all of its allowed connections.
• Slow POST attack: Similar to Slowloris, but by sending the request body at a very slow speed (for example, 1 byte every 10 seconds).
• API attack: Repeatedly calling a heavy endpoint such as search or report generation, which executes complex database queries.

Detecting L7 attacks is harder because the traffic resembles the behavior of normal users. A normal HTTP request and an attack request may be completely identical in structure.

Combined and new attacks

Today, most serious attacks are combined. The attacker first saturates bandwidth with an L4 attack to draw the attention of the security team, and simultaneously tries to bypass the WAF with an L7 attack. Some new attacks also use QUIC or WebSocket protocols, which are more complex to filter.

What actually stops a DDoS attack?

Many common solutions — such as increasing bandwidth or using hardware firewalls — are not very effective against modern attacks. In the following, we examine solutions that work in practice.

Traffic filtering at the network edge (Edge Filtering)

The most important principle in countering a DDoS attack is that attack traffic should never reach your main server. If the attack reaches your infrastructure, it's already too late. The standard solution is to filter traffic at the network edge — that is, where the data center connects to the internet.

Cloud services such as Cloudflare, Akamai, or similar domestic services route your traffic through their own network. When an attack begins, fake traffic is identified and discarded at the network edge, and only clean traffic reaches your server. This is done using the following techniques:

• Behavioral analysis: Examining packet rates, new connection rates, and temporal patterns to detect anomalies.
• Protocol validation: Checking whether TCP packets have completed the three-way Handshake. SYN packets without the corresponding ACK are discarded.
• IP blacklist: Blocking known IP addresses that have been used in attacks before.
• Rate Limiting: Limiting the number of requests from each IP per unit of time.

Important note: If your service is hosted in Iran and your audience is also in Iran, using foreign services may not be practical due to sanctions or network latency. In this case, you should use domestic DDoS protection services. Companies like ServerNet, alongside their web hosting and cloud services, also offer DDoS mitigation solutions to their customers, which can be a suitable option for Iranian businesses.

Proper server and software configuration

No cloud service can replace a properly configured server. Be sure to apply the following settings on your server:

1. Adjust Linux kernel parameters: In the /etc/sysctl.conf file, set the following values to increase resistance against SYN Flood:

   net.ipv4.tcp_syncookies = 1
   net.ipv4.tcp_synack_retries = 2
   net.ipv4.tcp_max_syn_backlog = 4096
   net.ipv4.icmp_echo_ignore_broadcasts = 1
   net.ipv4.conf.all.rp_filter = 1

   Then apply the changes with the sysctl -p command.
2. Limit concurrent connections: With iptables, you can limit the number of simultaneous connections from each IP:

   iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j REJECT

   This rule allows each IP to have a maximum of 50 simultaneous connections to port 80.
3. Rate limit requests with Nginx: In your server block, configure:

   limit_req_zone $binary_remote_addr zone=req_limit:10m rate=10r/s;
   server {
       location / {
           limit_req zone=req_limit burst=20 nodelay;
       }
   }

   This setting allows each IP to send a maximum of 10 requests per second.
4. Enable WAF: If you use Nginx, install the ModSecurity module and enable the OWASP CRS rules. This prevents many L7 attacks.

Scalable and distributed infrastructure

If your service runs on a single server, even the best filter cannot prevent bandwidth saturation. Consider the following solutions:

• Using a CDN: Put your site's static content on a CDN so that static requests don't reach the main server.
• Load Balancing: Distribute traffic among several servers so that if one goes down, the others can still respond.
• Microservice architecture: Instead of one large monolith, separate the services so that an attack on one part doesn't take down the entire system.

Common mistakes in countering DDoS attacks

Over the years of working with clients, I have repeatedly seen several mistakes that make the outcome of attacks much worse:

• Waiting for the attack to start: Many businesses only think about a solution after the first attack. But setting up a DDoS protection service takes time, and in the middle of an attack it's already too late. The protection infrastructure must be ready before an attack.
• Relying on a hardware firewall alone: Regular firewalls are designed for normal traffic, and against high-volume attacks, they themselves become the first point of failure.
• Completely closing ports: Some teams close all ports in the middle of an attack. This also takes the service down for real users and effectively achieves the same result as the attack itself.
• Ignoring logs: After each attack, review the server and firewall logs to understand the attack pattern. This information is critical for fine-tuning filters for the next attack.

Summary: Your action plan

For real protection against DDoS attacks, follow these steps in order:

1. Assess which layers your service is most vulnerable at. If you have a high-traffic e-commerce site, L7 attacks are probably more important; if you provide gaming or streaming services, L3/L4 attacks are the main threat.
2. Set up the network edge protection infrastructure before any attack. Entrust this to a specialized company or use ready-made services.
3. Apply the server settings according to the instructions above and test your server's resilience with tools like ab (Apache Bench) or wrk.
4. Write an incident response plan: who is responsible, who to contact, and what steps to take in order.
5. Periodically (for example, every 3 months) run a simulated low-volume attack to make sure your infrastructure still works.

A DDoS attack is a real and ongoing threat, but with a proper understanding of the attack layers and the use of appropriate solutions, you can minimize its risk. The key point is that protection must be ready before the attack, not after it.