# Attack types explained

> SYN and UDP floods, DNS/NTP/memcached amplification, ACK/RST and ICMP floods, carpet-bombing, and L7 HTTP attacks — and which product stops each.
>
> Canonical: https://xdp.network/docs/attack-mitigation/attack-types · Updated 2026-08-09

Floods differ in what they try to exhaust — your bandwidth, your connection state, or your
application. This page names the common types, what stops each one, and where the line
between OpenShield-XDP and PingLess WAF sits.

## Volumetric and protocol floods (L3/L4)

### SYN flood

The attacker streams TCP SYN packets, often from spoofed addresses, and never completes
the handshake. Your kernel fills its connection table with half-open sessions until real
clients can't connect. What stops it: OpenShield-XDP drops the flood at the XDP hook,
before any connection state is allocated.

### UDP flood

Aimed at services that speak UDP — game and voice servers especially — this flood fills
your link and receive path with junk datagrams. What stops it: baseline-plus-spike
detection spots the surge, and per-source accounting drops the offending streams while
real players pass.

### DNS, NTP, and memcached amplification

The attacker spoofs your IP and sends small queries to open reflectors — open DNS
resolvers, NTP servers, memcached instances — which answer you with much larger responses.
Reflection plus spoofing turns their small bandwidth into a large flood at your link. What
stops it: the amplified replies arrive as unsolicited UDP and are dropped at the NIC
before they consume your stack.

### ACK and RST floods

Junk TCP ACK or RST packets that match no real connection force your stack to look up
state that doesn't exist. What stops it: XDP drops them before socket-buffer allocation,
so the lookup cost never lands.

### ICMP floods

Ping floods try to saturate your link and CPU with echo traffic. What stops it: the same
per-source accounting and drop path handles ICMP at the driver hook.

## Carpet-bombing

Instead of hitting one address, the attacker spreads moderate traffic across your whole IP
range, so per-IP thresholds stay quiet while the aggregate fills the link. Mitigation
leans on the global baseline rather than per-source limits, and large campaigns are
escalated upstream — see [During an attack](/docs/attack-mitigation/during-an-attack).

## Application-layer floods (L7)

### Slowloris and HTTP floods

Slowloris holds web connections open with dribbling requests; HTTP floods hammer your app
with expensive-looking page or API calls. These target your web application, not your
network — they are [PingLess WAF](/docs/pingless-waf/overview) territory, absorbed at the
edge before they reach your server.

## Which product stops which attack

| Attack | Layer | Stopped by |
| --- | --- | --- |
| SYN flood | L4 | OpenShield-XDP |
| UDP flood | L4 | OpenShield-XDP |
| DNS / NTP / memcached amplification | L3/L4 | OpenShield-XDP |
| ACK / RST flood | L4 | OpenShield-XDP |
| ICMP flood | L3 | OpenShield-XDP |
| Carpet-bombing | L3/L4 | OpenShield-XDP + upstream escalation |
| Slowloris / HTTP flood | L7 | PingLess WAF |

## Next steps

- [How XDP filtering works](/docs/attack-mitigation/how-xdp-filtering-works)
- [PingLess WAF overview](/docs/pingless-waf/overview)
- [Glossary](/docs/getting-started/glossary)