A denial of service (DoS) attack is simple to explain: You have a server, which is responsible for serving information to the public. It takes a certain amount of processing power, network bandwidth, and memory to fulfill requests when another computer on the internet (the client) asks for information. Even if the request is bad, the server has to handle the request, and “deny service” to the client. If you can generate enough bad requests, which must all be denied, the server is left powerless to fulfill valid and proper requests.

In recent years, network and server technology has improved to the point where DoS attacks are hard to pull off. Servers and ISP’s are for the most part capable of absorbing the kind of traffic you might see in a typical DoS attack. We’ve gone from megabit (1 million bits/second) to gigabit (1 billion bits/second) traffic at the most narrow points, and as such, there is plenty of bandwidth for both legitimate and DoS traffic. To counter the increased growth, DoS attackers have developed ways to do DDoS or “distributed denial of service” attacks…

A DDoS attack is the same as a regular DoS, with the exception that DDoS attacks come from multiple clients at the same time. In order to do this, an attacker might have his attack code installed in hundreds or even thousands of clients which don’t even know they are now part of the attacker’s army. Virii, worms, trojans, etc… all ways to get attack code out to the masses. Then, remotely the attacker can summon all of his “zombie” clients (clients who have the attack code installed) simultaneously, and attack a single network or server. Of course this multiplies the DoS attack by the number of zombies the attacker controls.

A DDoS attack can be devastating. If you want to know just how bad it can be, and how much it can cost a business, read this awesome story (caution: it’s about a half hour read) called “How a Bookmaker and a Whiz Kid Took on an Extorsionist - And Won”.

Over the weekend (starting Friday afternoon), my primary DNS service (EveryDNS) was the victim of a serious DDoS attack. When EveryDNS went down, it took nearly 110,000 registered domain names with it. That is to say, that 110,000 websites were completely inaccessible by their domain name. Normally I’d be furious that a service provider (even a free service provider) put me offline for more than 2 days. Normally I’d be calling, emailing, and phoning for answers. EveryDNS’s website was offline too, so there wasn’t much I could do.

When the nameservers and EveryDNS’s website finally came back online, they posted a note about the DDoS attack. Again, I would normally have been pissed, but having read the story I linked above, I realized how hard everyone involved worked to fix it, and I applaud them for the minimal downtime they experienced. Of course I still use them, and recommend them to everyone with a domain name, but I’ve also put another failover level in. I’ve hooked my domains up to use EveryDNS nameservers first, but if they fail, I’m using a completely different company.

So if you were looking for the Average White Guy this weekend, he was not to be found online. Now you know why.