These countermeasures are very effective in locating specific DDoS attack tools by tricking the tools into identifying themselves or by analyzing the communication used to install, control, or initiate attacks. For example, DoS attacks can be used to crash a web server, or send a flood of communication that blocks legitimate visitors.
Flood attacks tend to consume the bandwidth of both the sender and the receiver.
Internet connectivity is like a pipe system, and the network with the biggest pipe will win in a flood attack. Because attackers do not have legitimate access to the required bandwidth, and because floods can sometimes be traced to the sender, attackers are motivated to break into other networks to use their bandwidth. This makes it more difficult to trace attackers, since they may have already covered their tracks. It is important to note that DDoS attacks do not require significant bandwidth from any single attack agent. Many small hoses can be coordinated to fill a very large pipe.