FortiDDos DDoS Attack Mitigation Guide - Fortinet

DDoS attack test conditions - a broad classification
Following diagram shows a more complex test bed. The appliances SmartBits and
Avalanche are packet generators. Such setups are typically used for third-party
performance tests.
Figure 10: A more complex test bench
DDoS attack test conditions - a broad classification
DDoS attacks can be broadly classified into following categories:
Spoofed floods vs. non-spoofed floods
A spoofed flood sends packets that seem to come from an IP that either does not exist
or did not actually send the packet.
A non-spoofed flood on the other hand comes from real IP addresses. Due to
proliferation of botnets, it is quite common these days to see non-spoofed attacks
coming from a large number of sources.
Anomalous header floods
These are packets which are typically generated by scripts. Scripts simple use loops to
increment certain header parameters. Since many of these header parameter values
may not be valid from standards perspective, they are anomalous. Examples of these
attacks are packets with invalid TCP flag combinations. If a packet has flags such as
RST, FIN, SYN, and ACK set simultaneously, it is anomalous.
FortiDDoS DDoS Attack Mitigation Guide
28-100-167076-20120501 26
http://docs.fortinet.com/ • Feedback