Denial-of-Service (DoS) Attack.

A denial-of-service attack overwhelms a single target — a server, application, link, or device — from one or a few sources, with the goal of degrading or stopping its service. It differs from DDoS, which marshals many distributed hosts; a plain DoS relies on asymmetry, where a small amount of attacker effort forces a large amount of victim work.

Techniques span the stack. Volumetric floods saturate bandwidth. Protocol abuse exhausts finite state: a SYN flood fills the connection backlog with half-open handshakes, which is why SYN cookies were invented. Slow attacks exploit patience over volume — Slowloris (Robert Hansen, 2009) trickles partial HTTP headers to pin every worker thread on a threaded server like Apache, needing almost no bandwidth. Application-layer resource exhaustion turns one request into disproportionate cost: expensive database queries, decompression of a zip/XML bomb, or ReDoS, where a catastrophically backtracking regular expression on attacker-controlled input consumes CPU for seconds per request. Algorithmic complexity attacks such as the 2011 hash-flooding disclosure (28C3) forced worst-case O(n²) behavior in the hash tables of many web frameworks. Classic malformed-packet crashes — Ping of Death, Teardrop, LAND — and local fork bombs round out the family.

Defences layer together: rate limiting and connection timeouts, SYN cookies, request-size and time budgets, capacity planning and autoscaling, upstream/anycast filtering, WAF rules, randomized hash seeds, and hardening code against inputs that trigger super-linear work.

flowchart TD
  A[Attacker: 1 or few hosts] --> B{Exhaust which resource?}
  B -->|Bandwidth| C[Volumetric flood]
  B -->|Connection state| D[SYN flood - half-open sockets]
  B -->|Worker threads| E[Slowloris - slow partial requests]
  B -->|CPU / memory| F[ReDoS, zip bomb,<br/>hash-flooding, costly query]
  B -->|Crash bug| G[Ping of Death / Teardrop / LAND]
  C --> H[Service unavailable to<br/>legitimate users]
  D --> H
  E --> H
  F --> H
  G --> H
  H --> I[Defences: rate limiting, SYN cookies,<br/>timeouts, WAF, autoscale, code hardening]