Attack types explained

On this page

• Volumetric and protocol floods (L3/L4)
• SYN flood
• UDP flood
• DNS, NTP, and memcached amplification
• ACK and RST floods
• ICMP floods
• Carpet-bombing
• Application-layer floods (L7)
• Slowloris and HTTP floods
• Which product stops which attack
• Next steps

Floods differ in what they try to exhaust — your bandwidth, your connection state, or your application. This page names the common types, what stops each one, and where the line between OpenShield-XDP and PingLess WAF sits.

Volumetric and protocol floods (L3/L4)#

SYN flood#

The attacker streams TCP SYN packets, often from spoofed addresses, and never completes the handshake. Your kernel fills its connection table with half-open sessions until real clients can't connect. What stops it: OpenShield-XDP drops the flood at the XDP hook, before any connection state is allocated.

UDP flood#

Aimed at services that speak UDP — game and voice servers especially — this flood fills your link and receive path with junk datagrams. What stops it: baseline-plus-spike detection spots the surge, and per-source accounting drops the offending streams while real players pass.

DNS, NTP, and memcached amplification#

The attacker spoofs your IP and sends small queries to open reflectors — open DNS resolvers, NTP servers, memcached instances — which answer you with much larger responses. Reflection plus spoofing turns their small bandwidth into a large flood at your link. What stops it: the amplified replies arrive as unsolicited UDP and are dropped at the NIC before they consume your stack.

ACK and RST floods#

Junk TCP ACK or RST packets that match no real connection force your stack to look up state that doesn't exist. What stops it: XDP drops them before socket-buffer allocation, so the lookup cost never lands.

ICMP floods#

Ping floods try to saturate your link and CPU with echo traffic. What stops it: the same per-source accounting and drop path handles ICMP at the driver hook.

Carpet-bombing#

Instead of hitting one address, the attacker spreads moderate traffic across your whole IP range, so per-IP thresholds stay quiet while the aggregate fills the link. Mitigation leans on the global baseline rather than per-source limits, and large campaigns are escalated upstream — see During an attack.

Application-layer floods (L7)#

Slowloris and HTTP floods#

Slowloris holds web connections open with dribbling requests; HTTP floods hammer your app with expensive-looking page or API calls. These target your web application, not your network — they are PingLess WAF territory, absorbed at the edge before they reach your server.

Which product stops which attack#

Next steps#

• How XDP filtering works
• PingLess WAF overview
• Glossary