Distributed Denial of Service (DDoS)

Lesson plan

Level

Beginner

Time

About 60 minutes; the steps below add up to 62

Learners work out three ways to stop a telephone shop serving customers, and whether a ticket rush is an attack, before denial of service is named. The clinic’s three limits are mapped to the shop, and each attack is predicted before it is worked through: what the server shows under a bandwidth flood, what runs out under half-open connections and why application requests are hard to spot; checks follow each case. The habit to build: find the exhausted resource first, then ask where a control must act to protect it.

Objectives

• Explain DoS and DDoS as attacks on availability, and the role of botnets
• Identify which resource is exhausted: bandwidth, connection handling or the application
• Match a mitigation to the bottleneck, and say where it must act
• Explain why blocking one address is rarely enough

Before the lesson

• Open this page on your own screen and use “Open the lesson window” to open the lesson in a second window. Share only that second window.
• Learners need the CIA Triad, HTTPS and Firewalls lessons first.
• Draw the shop’s line, assistant and stockroom as three boxes on the board, and keep them up for the clinic.
• The lesson takes about 62 minutes. To teach it in two parts, stop after “C. Application-layer exhaustion”; the second part opens with “Mitigation”.
• In presentation mode every step is shown in turns: Next reveals one moment, part or answer at a time, and the instructor view names what is on screen and what comes next.

Steps

1. Introduction Opening

   On screen: the lesson’s title, module and number; Next adds its objectives and key terms, as the lesson page lists them; Next again begins the first step.

   Objectives on screen

   • Explain DoS and DDoS as attacks on availability, and the role of botnets
   • Identify which resource is exhausted: bandwidth, connection handling or the application
   • Match a mitigation to the bottleneck, and say where it must act
   • Explain why blocking one address is rarely enough

   Purpose: Learners work out three ways to stop a telephone shop serving customers, and whether a ticket rush is an attack, before denial of service is named. The clinic’s three limits are mapped to the shop, and each attack is predicted before it is worked through: what the server shows under a bandwidth flood, what runs out under half-open connections and why application requests are hard to spot; checks follow each case. The habit to build: find the exhausted resource first, then ask where a control must act to protect it.

2. 1. The telephone shop Think 5 min

   Purpose: Derive the three ways to deny service from an everyday shop.

   Ask

   • How could someone stop customers being served?
   • Is a ticket rush an attack?

   Responses to expect

   • The engaged line comes first; the silent caller needs a hint.
   • On screen in turns: the opening question, its answer; then the question on a ticket rush, and its answer.

   Discussion pause: Take one idea for each part of the shop before revealing.

   In the lesson window

   • Think it through: A small shop takes orders by telephone. It has one phone line, one assistant and one stockroom. Without breaking in or stealing anything, how could someone stop genuine customers being served?
   • Think it through: A ticket sale opens and thousands of genuine fans try the website at once. It slows to a crawl. Is it an attack?

3. 2. The idea Explain 6 min

   Purpose: Name DoS, DDoS and botnets, and place DDoS under availability and Denial.

   Ask

   • Which part of the triad is threatened?

   Responses to expect

   • Some expect confidentiality; nothing is read.
   • On screen in turns: the opening; then three ways to stop the shop, starting with an engaged line; the stuck assistant; the stockroom that cannot keep up; denial of service, and distributed denial of service; botnets, and floods that are not attacks; the check question on the CIA triad, and its answer; availability, and Denial in DAD; where the shop comparison stops.

   Misconceptions to challenge

   • A learner may believe: “A DDoS attack steals or destroys data.” Respond: Its aim is to deny access; data may be untouched.

   In the lesson window

   • Check your understanding: Which part of the CIA triad does a DDoS attack mainly threaten?

4. 3. Worked example: a fictional online booking service Predict 4 min

   Purpose: Map the clinic’s three limits to the shop.

   Ask

   • Which part is the line, the assistant and the stockroom?

   Responses to expect

   • Most map them correctly.
   • On screen in turns: the opening; then the question on where the limits are, and its answer; the three limits in this example; three bottlenecks, not three stages.

   In the lesson window

   • Think it through: An online booking service has to carry traffic, accept new connections and look up appointments. Which of these matches the shop’s phone line, which its assistant and which its stockroom?

5. 4. A. Network bandwidth bottleneck Predict 6 min

   Purpose: Work through a bandwidth flood and why it must be stopped upstream.

   Ask

   • What do the server’s graphs show?
   • Why does the local firewall not help?

   Responses to expect

   • Many expect a busy server.
   • On screen in turns: the opening question, its answer; then case A, starting with the attack; the limit reached; what the engineer sees; what does not help; what helps; the check question on the clinic’s own firewall, and its answer; the point of case A.

   Misconceptions to challenge

   • A learner may believe: “A bigger server fixes a DDoS attack.” Respond: Only when the server itself is what ran out.

   Discussion pause: Reveal each case one line at a time; before “what does not help” and “what helps”, ask the class first. Cases B and C follow the same rhythm.

   In the lesson window

   • Think it through: Attackers send 400 Mbit/s of junk into the clinic’s 100 Mbit/s connection. Predict what the web server’s graphs show, and whether a more powerful server would help.
   • Check your understanding: Why does filtering on the clinic’s own firewall not help in case A?

6. 5. B. Connection or protocol exhaustion Predict 6 min

   Purpose: Work through connection exhaustion with little bandwidth.

   Ask

   • Ask what could still run out.
   • Would a faster line help?

   Responses to expect

   • “Nothing” is a common first answer.
   • On screen in turns: the opening question, its answer; then case B, starting with the attack; the limit reached; what the engineer sees; what does not help; what helps; the check question on a faster connection, and its answer; the point of case B.

   If the explanation does not land: Back to the shop: callers who ring, say nothing and stay on the line.

   In the lesson window

   • Think it through: This time the attackers send only 5 Mbit/s, but 2,000 requests a second to open a connection, and never finish any of them. The connection is nearly empty. What could still run out?
   • Check your understanding: The clinic’s manager wants to buy a faster internet connection to stop attack B. Will it help?

7. 6. C. Application-layer exhaustion Predict 8 min

   Purpose: Work through application-layer exhaustion and reading the symptoms.

   Ask

   • Why would counting traffic not reveal it?
   • Which bottleneck do the symptoms point to?

   Responses to expect

   • The database answer comes once learners ask what a search needs.
   • On screen in turns: the opening question, its answer; then case C, starting with the attack; the limit reached; what the engineer sees; what does not help; what helps; the point of case C; caching at the edge, and where the layers are taught; reading the symptoms, starting with full connection graphs; spare capacity, but connections time out; pages load, but searches hang; what the symptoms do not prove; the check question on reading the symptoms, and its answer; reflected and amplified attacks.

   To go further

   • How could the clinic make its slowest search cheaper for every user, not just limit it?

   In the lesson window

   • Think it through: Suppose every attacking request looks exactly like a real customer’s search, but asks for the slowest search the site offers. Which part fills up, and why would counting traffic not reveal it?
   • Check your understanding: Customers report that the home page loads but every search hangs. The connection graph is at 20%. Which bottleneck does this point to?

8. 7. Mitigation Predict 6 min

   Purpose: Compare the main controls and what each cannot do.

   Ask

   • Which control for each attack?

   Responses to expect

   • Learners often pick one control for everything.
   • The limitations column is held back: ask what each control cannot do before revealing it.
   • On screen in turns: the opening question, its answer; then the main mitigations; the controls compared, with their limitations held back; the limitation of each control.

   In the lesson window

   • Think it through: For each of the three clinic attacks, which kind of control would you reach for first?

9. 8. Why layers matter Predict 7 min

   Purpose: Show controls at different points on the path, and the limits of blocking an address.

   Ask

   • Why might blocking one address fail?
   • Which response fits a healthy link and a busy database?

   Responses to expect

   • The shared-address problem is new to many.
   • Diagram: step through the path one point at a time, asking which of the three bottlenecks each point can help with.
   • On screen in turns: the opening; then the defensive path, one point at a time; the diagram’s stages one at a time; the check question on the overloaded database, and its answer; matching the control to the exhausted resource; the question on blocking one address, and its answer; why blocking one address may not be enough; preparing before an attack.

   Misconceptions to challenge

   • A learner may believe: “Blocking the attacking IP address stops it.” Respond: Sources are many and change; one address may be many users.

   In the lesson window

   • Check your understanding: The link is healthy but the database is overloaded. Which response targets the constrained resource?
   • Think it through: An engineer sees one address sending a lot of traffic and blocks it. Why might that not be enough, and what might it break?

10. 9. Apply it in a new situation Apply 5 min

    Purpose: Set up independent application, ideally on a later day.

    Ask

    • Who will try these now, and who later in the week?

    Responses to expect

    • The festival tests legitimate surges; the school tests shared addresses; the card question tests what DDoS does.
    • On screen in turns: the opening; then the question on festival tickets, and its answer; the question on a school locked out, and its answer; the question on card details, and its answer.

    In the lesson window

    • Apply it: A festival’s ticket site slows to a crawl the moment sales open. Before calling it a DDoS attack, what should be checked?
    • Apply it: A strict per-address limit is applied during an attack, and a whole school suddenly cannot book appointments. What is the likely reason?
    • Apply it: After a DDoS attack on a shop’s website, a manager asks whether customer card details were stolen. What does the attack alone tell you?

11. 10. Check your understanding Check 5 min

    Purpose: Check the lesson against the approved revision-bank questions.

    Ask

    • Answer individually, then compare before revealing.

    Responses to expect

    • Each bank question maps to one of the three cases.
    • On screen in turns: the opening; then the revision questions one at a time, each followed by its answer; where to practise next.

12. 11. Revision takeaway Consolidate 4 min

    Purpose: Consolidate the three questions to ask, the five points, the key terms and the misunderstandings.

    Ask

    • Without looking: the three questions to ask about any DDoS.

    Responses to expect

    • Which resource is exhausted, where a control must act, and how legitimate access will be checked.
    • On screen in turns: the opening; then how DDoS differs from the attack chain; what to remember; the key terms; the common misunderstandings.

13. Lesson recap Closing

    On screen: the lesson’s objectives again; Next adds the closing question, which asks the class to explain each one in their own words without looking back. It says nothing about what anyone has learnt: use the answers to decide what to revisit.

    Points to listen for

    • Denial, not theft.
    • Find the exhausted resource first.
    • Bandwidth: stop it upstream.
    • Connections: protect the connection handling.
    • Application: understand the application; and never rely on blocking one address.

Consolidation

• Denial, not theft.
• Find the exhausted resource first.
• Bandwidth: stop it upstream.
• Connections: protect the connection handling.
• Application: understand the application; and never rely on blocking one address.