{
  "schemaVersion": "1.0",
  "dataset": "ddos-attack-vectors",
  "title": "DDoS attack vectors",
  "description": "A reference classification of DDoS attack vectors: layer, what each exhausts, whether it can be spoofed or reflected, and the first-line mitigation. Editorial classification; amplification magnitudes are in a separate sourced dataset.",
  "lastUpdated": "2026-08-15",
  "license": "Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.",
  "sources": [
    {
      "id": "rfc-4732",
      "title": "RFC 4732 — Internet Denial-of-Service Considerations",
      "publisher": "IETF",
      "url": "https://www.rfc-editor.org/rfc/rfc4732.html",
      "publishedDate": "2006-11",
      "accessedDate": "2026-08-15",
      "notes": "The framing of vectors as resource exhaustion behind the category and resource columns."
    },
    {
      "id": "cisa-ta14-017a",
      "title": "Alert TA14-017A: UDP-Based Amplification Attacks",
      "publisher": "CISA",
      "url": "https://www.cisa.gov/news-events/alerts/2014/01/17/udp-based-amplification-attacks",
      "publishedDate": "2014-01-17",
      "accessedDate": "2026-08-15",
      "notes": "Amplification factors referenced in the resource column; see the amplification-factors dataset for the figures."
    }
  ],
  "changelog": [
    {
      "date": "2026-08-15",
      "note": "Initial release: 17 vectors across volumetric, protocol, reflection, application-layer and campaign categories."
    }
  ],
  "rowCount": 17,
  "data": [
    {
      "id": "udp-flood",
      "name": "UDP flood",
      "aliases": "volumetric UDP",
      "category": "volumetric",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "no",
      "resourceExhausted": "bandwidth, packet-processing budget",
      "detectionSignal": "high packet rate to closed or unexpected UDP ports",
      "firstLineMitigation": "upstream rate limiting; drop unsolicited UDP at the edge"
    },
    {
      "id": "tcp-syn-flood",
      "name": "TCP SYN flood",
      "aliases": "SYN flood",
      "category": "protocol / state exhaustion",
      "layer": "L4",
      "spoofable": "yes",
      "reflection": "no",
      "resourceExhausted": "half-open connection table",
      "detectionSignal": "high SYN rate with low handshake completion",
      "firstLineMitigation": "SYN cookies or SYN proxy (RFC 4987)"
    },
    {
      "id": "tcp-ack-flood",
      "name": "TCP ACK flood",
      "aliases": "ACK flood",
      "category": "protocol / state exhaustion",
      "layer": "L4",
      "spoofable": "yes",
      "reflection": "no",
      "resourceExhausted": "session-table lookups on stateful devices",
      "detectionSignal": "ACKs for sessions that do not exist",
      "firstLineMitigation": "stateless validation ahead of the stateful tier"
    },
    {
      "id": "icmp-flood",
      "name": "ICMP flood",
      "aliases": "ping flood",
      "category": "volumetric",
      "layer": "L3",
      "spoofable": "yes",
      "reflection": "no",
      "resourceExhausted": "bandwidth",
      "detectionSignal": "high ICMP echo rate",
      "firstLineMitigation": "ICMP rate limiting upstream"
    },
    {
      "id": "ip-fragmentation",
      "name": "IP fragmentation attack",
      "aliases": "fragment flood, teardrop-class",
      "category": "protocol / state exhaustion",
      "layer": "L3",
      "spoofable": "yes",
      "reflection": "no",
      "resourceExhausted": "reassembly buffers",
      "detectionSignal": "high rate of fragments, many without a first fragment",
      "firstLineMitigation": "fragment reassembly limits; drop malformed fragments"
    },
    {
      "id": "dns-amplification",
      "name": "DNS amplification",
      "aliases": "DNS reflection",
      "category": "reflection / amplification",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "yes",
      "resourceExhausted": "bandwidth (factor 28–54, see amplification dataset)",
      "detectionSignal": "large DNS responses to a victim that sent no query",
      "firstLineMitigation": "ingress filtering (BCP 38); response-rate limiting on resolvers"
    },
    {
      "id": "ntp-amplification",
      "name": "NTP amplification",
      "aliases": "NTP reflection, monlist",
      "category": "reflection / amplification",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "yes",
      "resourceExhausted": "bandwidth (factor ~557, see amplification dataset)",
      "detectionSignal": "large NTP responses to a non-requesting host",
      "firstLineMitigation": "disable monlist; ingress filtering upstream"
    },
    {
      "id": "memcached-amplification",
      "name": "Memcached amplification",
      "aliases": "memcrashed",
      "category": "reflection / amplification",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "yes",
      "resourceExhausted": "bandwidth (factor up to ~51,000, see amplification dataset)",
      "detectionSignal": "very large UDP responses from port 11211",
      "firstLineMitigation": "never expose memcached to the internet; disable UDP"
    },
    {
      "id": "ssdp-amplification",
      "name": "SSDP amplification",
      "aliases": "UPnP reflection",
      "category": "reflection / amplification",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "yes",
      "resourceExhausted": "bandwidth (factor ~31, see amplification dataset)",
      "detectionSignal": "SSDP SEARCH responses to a non-requesting host",
      "firstLineMitigation": "block SSDP at the border; ingress filtering"
    },
    {
      "id": "dns-flood",
      "name": "DNS query flood",
      "aliases": "authoritative DNS flood",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "partial",
      "reflection": "no",
      "resourceExhausted": "resolver / authoritative CPU and query budget",
      "detectionSignal": "high query rate, often for random subdomains",
      "firstLineMitigation": "response-rate limiting; anycast; query validation"
    },
    {
      "id": "dns-water-torture",
      "name": "Random subdomain attack",
      "aliases": "DNS water torture",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "partial",
      "reflection": "no",
      "resourceExhausted": "authoritative server and cache, via non-existent names",
      "detectionSignal": "flood of queries for random non-existent subdomains of one zone",
      "firstLineMitigation": "NXDOMAIN rate limiting; cache tuning"
    },
    {
      "id": "http-flood",
      "name": "HTTP flood",
      "aliases": "L7 flood",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "no",
      "reflection": "no",
      "resourceExhausted": "web/application server workers, backend queries",
      "detectionSignal": "high request rate to expensive endpoints from valid-looking clients",
      "firstLineMitigation": "application rate limiting; challenge suspicious clients"
    },
    {
      "id": "http2-rapid-reset",
      "name": "HTTP/2 Rapid Reset",
      "aliases": "CVE-2023-44487",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "no",
      "reflection": "no",
      "resourceExhausted": "server request-handling via rapid stream open/cancel",
      "detectionSignal": "high rate of HTTP/2 streams reset immediately after opening",
      "firstLineMitigation": "patched server; limit concurrent and cancelled streams"
    },
    {
      "id": "slowloris",
      "name": "Slowloris / slow HTTP",
      "aliases": "low-and-slow",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "no",
      "reflection": "no",
      "resourceExhausted": "concurrent connection slots held open at low rate",
      "detectionSignal": "many long-lived connections sending headers or bodies very slowly",
      "firstLineMitigation": "request timeouts; connection limits per source; a proxy that buffers"
    },
    {
      "id": "tls-renegotiation",
      "name": "TLS / HTTPS DDoS",
      "aliases": "TLS exhaustion",
      "category": "application-layer",
      "layer": "L7",
      "spoofable": "no",
      "reflection": "no",
      "resourceExhausted": "CPU spent on handshakes and cryptographic work",
      "detectionSignal": "high rate of new TLS handshakes or renegotiations",
      "firstLineMitigation": "handshake rate limiting; session resumption; offload"
    },
    {
      "id": "carpet-bombing",
      "name": "Carpet bombing",
      "aliases": "spread-spectrum attack",
      "category": "campaign pattern",
      "layer": "L3/L4",
      "spoofable": "yes",
      "reflection": "partial",
      "resourceExhausted": "aggregate circuit capacity across a whole prefix",
      "detectionSignal": "rising aggregate volume with no single destination over threshold",
      "firstLineMitigation": "prefix-level detection; FlowSpec or RTBH on the aggregate"
    },
    {
      "id": "pulse-wave",
      "name": "Pulse-wave DDoS",
      "aliases": "burst attack",
      "category": "campaign pattern",
      "layer": "L3/L4/L7",
      "spoofable": "yes",
      "reflection": "partial",
      "resourceExhausted": "whichever tier the burst targets, exploiting slow diversion",
      "detectionSignal": "repeated short high-intensity bursts timed against mitigation response",
      "firstLineMitigation": "always-on inline mitigation rather than on-demand diversion"
    }
  ]
}