There are many types of DDoS attacks. But generally, they fall into three main categories. 1) Volumetric – These attacks attempt to consume the bandwidth either within the target network/service, or between the target network/service and the rest of the Internet. A common technique is to exploit certain protocols (of which there are many such as DNS, Memcached, NTP, Chargen) to execute large reflection/amplification attacks that are routinely hundreds of Gbps in size. 2) TCP State exhaustion attacks - These attacks attempt to consume the connection state tables which are present in many infrastructure components such as load-balancers, firewalls and the application servers themselves. Even high capacity devices capable of maintaining state on millions of connections can be taken down by these attacks. 3) Application layer - These attacks target some aspect of an application or service at Layer-7. These are the deadliest kind of attacks as they can be very effective with as few as one attacking machine generating a low traffic rate (this makes these attacks very difficult to pro-actively detect and mitigate). Application layer attacks have come to prevalence over the past three or four years and simple application layer flood attacks (HTTP GET flood etc.) have been some of the most common denial of service attacks seen in the wild.
Today’s sophisticated attackers are blending volumetric, state exhaustion and application-layer attacks against infrastructure devices all in a single, sustained attack. This is what’s known as a multi-vector DDoS attack. These attacks are popular because they easy to launch with DDoS attack tools or services and difficult to defend against.