Dataset
DDoS attack vectors
A reference classification of DDoS attack vectors: layer, what each exhausts, whether it can be spoofed or reflected, and the first-line mitigation. Editorial classification; amplification magnitudes are in a separate sourced dataset.
- Rows
- 17
- Last updated
- 2026-08-15
- Schema version
- 1.0
DDoS attack vectors
| Vector | Aliases | Category | Layer | Spoofable | Reflection | Resource exhausted | Detection signal | First-line mitigation |
|---|---|---|---|---|---|---|---|---|
| UDP flood | volumetric UDP | volumetric | L3/L4 | yes | no | bandwidth, packet-processing budget | high packet rate to closed or unexpected UDP ports | upstream rate limiting; drop unsolicited UDP at the edge |
| TCP SYN flood | SYN flood | protocol / state exhaustion | L4 | yes | no | half-open connection table | high SYN rate with low handshake completion | SYN cookies or SYN proxy (RFC 4987) |
| TCP ACK flood | ACK flood | protocol / state exhaustion | L4 | yes | no | session-table lookups on stateful devices | ACKs for sessions that do not exist | stateless validation ahead of the stateful tier |
| ICMP flood | ping flood | volumetric | L3 | yes | no | bandwidth | high ICMP echo rate | ICMP rate limiting upstream |
| IP fragmentation attack | fragment flood, teardrop-class | protocol / state exhaustion | L3 | yes | no | reassembly buffers | high rate of fragments, many without a first fragment | fragment reassembly limits; drop malformed fragments |
| DNS amplification | DNS reflection | reflection / amplification | L3/L4 | yes | yes | bandwidth (factor 28–54, see amplification dataset) | large DNS responses to a victim that sent no query | ingress filtering (BCP 38); response-rate limiting on resolvers |
| NTP amplification | NTP reflection, monlist | reflection / amplification | L3/L4 | yes | yes | bandwidth (factor ~557, see amplification dataset) | large NTP responses to a non-requesting host | disable monlist; ingress filtering upstream |
| Memcached amplification | memcrashed | reflection / amplification | L3/L4 | yes | yes | bandwidth (factor up to ~51,000, see amplification dataset) | very large UDP responses from port 11211 | never expose memcached to the internet; disable UDP |
| SSDP amplification | UPnP reflection | reflection / amplification | L3/L4 | yes | yes | bandwidth (factor ~31, see amplification dataset) | SSDP SEARCH responses to a non-requesting host | block SSDP at the border; ingress filtering |
| DNS query flood | authoritative DNS flood | application-layer | L7 | partial | no | resolver / authoritative CPU and query budget | high query rate, often for random subdomains | response-rate limiting; anycast; query validation |
| Random subdomain attack | DNS water torture | application-layer | L7 | partial | no | authoritative server and cache, via non-existent names | flood of queries for random non-existent subdomains of one zone | NXDOMAIN rate limiting; cache tuning |
| HTTP flood | L7 flood | application-layer | L7 | no | no | web/application server workers, backend queries | high request rate to expensive endpoints from valid-looking clients | application rate limiting; challenge suspicious clients |
| HTTP/2 Rapid Reset | CVE-2023-44487 | application-layer | L7 | no | no | server request-handling via rapid stream open/cancel | high rate of HTTP/2 streams reset immediately after opening | patched server; limit concurrent and cancelled streams |
| Slowloris / slow HTTP | low-and-slow | application-layer | L7 | no | no | concurrent connection slots held open at low rate | many long-lived connections sending headers or bodies very slowly | request timeouts; connection limits per source; a proxy that buffers |
| TLS / HTTPS DDoS | TLS exhaustion | application-layer | L7 | no | no | CPU spent on handshakes and cryptographic work | high rate of new TLS handshakes or renegotiations | handshake rate limiting; session resumption; offload |
| Carpet bombing | spread-spectrum attack | campaign pattern | L3/L4 | yes | partial | aggregate circuit capacity across a whole prefix | rising aggregate volume with no single destination over threshold | prefix-level detection; FlowSpec or RTBH on the aggregate |
| Pulse-wave DDoS | burst attack | campaign pattern | L3/L4/L7 | yes | partial | whichever tier the burst targets, exploiting slow diversion | repeated short high-intensity bursts timed against mitigation response | always-on inline mitigation rather than on-demand diversion |
Sources
- RFC 4732 — Internet Denial-of-Service Considerations
IETF · 2006-11 · accessed 2026-08-15
The framing of vectors as resource exhaustion behind the category and resource columns.
- Alert TA14-017A: UDP-Based Amplification Attacks
CISA · 2014-01-17 · accessed 2026-08-15
Amplification factors referenced in the resource column; see the amplification-factors dataset for the figures.
What changed
- 2026-08-15Initial release: 17 vectors across volumetric, protocol, reflection, application-layer and campaign categories.
Reuse: Free to reuse with attribution to ddosmitigationguide.com; source citations must be preserved.