DDoS Attack Analysis & Mitigation: Network Architecture and Hardening Guide

Distributed Denial of Service (DDoS) attacks represent one of the primary threats to critical system availability. Unlike intrusion attempts aiming at data exfiltration, the objective of a DDoS vector is exhausting computational or network resources.

1. Architectural Fundamentals: DoS vs DDoS

• Denial of Service (DoS): Originated from a single IP source. Easily mitigated using static filtering or iptables block rules.
• Distributed Denial of Service (DDoS): Coordinated across botnets comprising thousands of compromised nodes (IoT devices, vulnerable servers). The geographically distributed nature makes basic IP filtering ineffective.

2. IP Spoofing and Amplification Vectors

• IP Spoofing: Forging the source IP address in outgoing IP headers to redirect response traffic to the victim's server.
• UDP Amplification: Leveraging connectionless protocols (DNS, NTP, SNMP) where a small request yields a large payload response directed to the spoofed target IP.

3. Linux Kernel Hardening (/etc/sysctl.conf)

net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 4096
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1