# Network Denial of Service (DoS)

A Denial of Service (DoS) attack aims to make a machine or network resource unavailable to its intended users. It does not aim to steal data, but rather to disrupt operations. A Distributed Denial of Service (DDoS) attack uses a botnet (thousands of compromised computers) to execute the attack simultaneously.

## Layer 4: SYN Flood
This attack exploits the stateful nature of the TCP 3-Way Handshake.

*   The attacker sends a massive flood of **SYN** requests (Step 1) to a web server.
*   The server replies to each with a **SYN-ACK** (Step 2) and leaves a "half-open" connection waiting in its memory for the final **ACK** (Step 3).
*   The attacker intentionally *never* sends the final ACK. Sometimes they even spoof the source IP address of the initial SYN, so the server is sending the SYN-ACK to a random, offline IP.
*   **The Result:** The web server's memory fills up with thousands of half-open connections. Eventually, it runs out of resources and drops legitimate new connections from real customers.

## Layer 3 & 4: Amplification/Reflection Attacks
Attackers love "Amplification" attacks because they act as a force multiplier. They send a tiny request and generate a massive response aimed at the victim. This relies on connectionless UDP protocols.

**The Smurf Attack (ICMP):**
1.  The attacker sends an ICMP Echo Request (Ping) to a network's broadcast address (e.g., `192.168.1.255`).
2.  However, the attacker *spoofs* the source IP Address of the ping to be the Victim's IP address.
3.  Every single computer on that network (maybe 200 machines) receives the ping, and all 200 simultaneously reply with an ICMP Echo Reply directed at the Victim.
4.  One tiny packet from the attacker generated 200 packets hitting the victim.

**DNS/NTP Amplification:**
1.  The attacker sends a tiny UDP DNS Query (like "give me all records for this domain") to an open DNS server on the internet.
2.  They spoof the source IP to be the Victim's IP.
3.  The DNS server generates a massive response (sometimes 50x larger than the request) and blasts it at the Victim.
4.  Using a botnet, the attacker directs thousands of open DNS servers to reflect massive chunks of traffic at the victim, saturating their internet connection completely.