Attacks
Attack classes
An attack class is worth writing about only through three questions: what resource it exhausts, what makes it visible before a customer calls, and which tier of the defence can answer it. A campaign that saturates a transit circuit and a campaign that exhausts a session table look identical on a bandwidth graph and demand opposite responses, and most bad architecture decisions start with that confusion.
The pages below read each class structurally rather than dramatically. Where an attack has a name in the trade press, the name is used, but the argument is about counters — distinct-destination cardinality, request concurrency, state-table pressure — because those are what a rulebook can act on and what an acceptance test can reproduce.
None of these pages tells you how to run an attack. Validation guidance is written for the defender, and the safe way to test a defence is against your own infrastructure with authorisation in writing.
Start here
How Modern Appliances Detect and Mitigate Carpet-Bombing DDoS Attacks
Prefix-level detection and response
Hacktivist DDoS Campaigns: What Their Structure Means for Defenders
A threat class read structurally
The DDoS Threat Landscape for Middle East Organisations: A Structural Reading
Exposure structure, attack classes and what they imply for design
Go deeper
Attack class · Last updated August 2026
DNS Query Flood
A straight flood of valid DNS queries at a server that must answer every one. No amplification, no malformation, nothing to signature — which is exactly what makes it hard to separate from a busy day.
Attack class · Last updated August 2026
HTTP/2 Rapid Reset
A protocol feature turned into a weapon: open a stream, cancel it immediately, repeat. The concurrency limit that was supposed to bound the work never applies, because no stream stays open long enough to count.
Attack class · Last updated August 2026
ICMP Flood
The oldest flood still in circulation, and the one most often over-mitigated. What it costs, why blocking ICMP entirely breaks things you rely on, and the narrow set of message types that actually matter.
Attack class · Last updated August 2026
IP Fragmentation Attacks
Fragments that never complete, overlap, or arrive out of order force a receiver to hold reassembly state for packets that will never exist. It exhausts memory rather than bandwidth and is invisible to anything counting bit rate.
Attack class · Last updated August 2026
Pulse Wave Attacks
Repeated bursts, each ending before detection and diversion complete. The attack is not aimed at your capacity; it is aimed at the interval between noticing and acting, which is why more capacity does not help.
Attack class · Last updated August 2026
TCP ACK Flood
A flood of packets that look like they belong to established conversations. Every one forces a session-table lookup that finds nothing, and defences built around validating handshakes never see it coming.
Attack class · Last updated August 2026
TLS Handshake and Renegotiation Attacks
A handshake costs the server far more than the client, and a client that asks for handshakes repeatedly turns that ratio into an attack. Why the cost is asymmetric, what modern protocol versions changed, and what actually bounds it.
Attack class · Last updated August 2026
Multi-Vector DDoS
A campaign that changes vector mid-attack is not three attacks in sequence. It is one attack probing for the layer where your defence is thinnest, and it defeats architectures that handle each vector well in isolation.
Attack class · Last updated August 2026
DDoS as a Smokescreen: What the SOC Should Watch in Parallel
A flood consumes two finite resources besides bandwidth: analyst attention and the capacity of the controls behind it. Both create blind spots. What that means for confidentiality and integrity, and a parallel monitoring list for the hour it is happening.
Attack class · Last updated August 2026
Carpet Bombing
Carpet bombing spreads volume across a whole prefix so no single address crosses a threshold while the aggregate saturates the link. A detection problem before it is a mitigation problem.
Attack class · Last updated August 2026
DNS Water Torture and Random Subdomain Attacks
Random subdomain attacks defeat DNS caching by construction: every query is for a name that has never existed. Why the resolver in the middle suffers too, and what actually bounds it.
Attack class · Last updated August 2026
HTTP Flood and Application-Layer Attacks
An HTTP flood sends requests that are individually legitimate and collectively ruinous. Why volume tells you nothing here, what distinguishes it from a traffic surge, and why the defence has to know what your application costs.
Attack class · Last updated August 2026
Reflection and Amplification Attacks
Reflection hides the attacker behind innocent servers; amplification makes their bandwidth multiply. Why the two are separate properties, which protocols carry which factor, and why the countermeasure is somebody else's to deploy.
Attack class · Last updated August 2026
Slowloris and Slow HTTP Attacks
Slow HTTP attacks hold connections open by sending data as slowly as the server will tolerate. Why the defence is a timeout rather than a filter, and why architecture decides whether you are exposed at all.
Attack class · Last updated August 2026
TCP SYN Flood
A SYN flood consumes half-open connection slots rather than bandwidth, which is why a firewall rated in tens of gigabits falls to a few hundred megabits of it. How to recognise it in telemetry and which defence actually applies.
Attack class · Last updated August 2026
UDP Flood
A direct UDP flood consumes bandwidth with no leverage and no concealment. What separates it from reflection, why the sources are sometimes real, and why nothing in your rack answers it.