What are flooding attacks?

Flooding attacks are a type of network attack in which the attacker floods a system with a huge number of requests to overload it and make it unavailable.

In simple terms: the server receives so many requests that it "chokes" and stops working normally.

---

#The essence of flooding attacks

Every system has limited resources:

• CPU,
• memory,
• network bandwidth,
• the number of simultaneous connections.

A flooding attack exhausts these resources, even if the requests formally look correct.

The goal is almost always the same - to break the availability of the service.

---

#What flooding attacks belong to

Flooding is the basis for:

• DoS (attack from a single source),
• DDoS (attack from many sources).

---

#Main types of flooding attacks

#1. SYN Flood

How it works:

• the attacker sends many TCP connection requests;
• the connection is never completed;
• the server keeps "half-open" connections.

As a result, the server cannot accept new connections.

---

#2. UDP Flood

How it works:

• a huge number of UDP packets are sent;
• the server tries to process or respond to them.

This very quickly overloads the channel and the CPU.

---

#3. ICMP Flood (Ping Flood)

How it works:

• the server is flooded with ICMP requests (ping);
• it spends resources on replies.

Often used to overload the network.

---

#4. HTTP Flood

How it works:

• the server receives many HTTP requests;
• the requests look like ordinary user requests.

Dangerous because it is hard to distinguish from legitimate traffic.

---

#What a flooding attack violates

• Availability, from the CIA triad.

Data is not stolen or altered - the service simply stops working.

---

#How to defend against flooding attacks

#Main defense measures:

• limiting the number of requests (rate limiting);
• firewall and traffic filtering;
• IDS/IPS;
• anti-DDoS services;
• load balancing.