Distributed denial-of-service (DDoS) attacks are becoming more sophisticated, employing a multi-pronged approach to overwhelm target systems. These attacks exploit vulnerabilities across three of the seven layers of the Open Systems Interconnection (OSI) model, the foundational framework for network communication. This article explains how OSI and DDoS are related, and the details of DDoS attacks at L3, L4, and L7 of the OSI model. We’ll share best practices for implementing a strong, multi-layered DDoS protection strategy to combat this type of threat effectively.
How DDoS Attacks and the OSI Model Are Connected
Distributed denial-of-service (DDoS) attacks occur when an influx of traffic is intentionally sent to a server, rendering it unavailable to users. DDoS attackers use a range of techniques designed to overwhelm servers with traffic to make the target server unavailable. The type of attack and the OSI network layer it targets inform mitigation strategies.
A network is a system of interconnected devices capable of sharing resources and data, allowing them to communicate with each other, regardless of their type or brand. These devices can exchange information and access shared resources, operating within the seven layers of the OSI model. The OSI model outlines a layered structure where each layer has specific functions and interacts with its adjacent layers. This organization simplifies network processes and supports the interoperability of network devices and software from different vendors.
DDoS attacks target layers 3, 4, and 7 of the OSI model, each of which has distinct vulnerabilities and attack methods. These layers are targeted because they deal with routing, establishing connections, and application functions, which can all be overwhelmed with malicious traffic.
The Impact of DDoS Attacks on Networks
When a DDoS attack targets these layers, the entire network’s ability to communicate effectively is compromised. An attack might flood the network layer with excessive data packets or exploit software vulnerabilities at the application layer. Generally, if the device processing the traffic is hit at L3, it can’t handle operations related to the network. So L7, which depends on the outcomes of L3 operations, also fails.
Each user on a network generates traffic that exhibits patterns at different layers, reflecting their behavior. Legitimate user patterns differ significantly from those of attackers. By monitoring and analyzing these patterns, security systems can accurately distinguish between genuine users and potential attackers, thereby mitigating DDoS attacks at any given layer.
Let’s look at each of the seven layers in turn. At layers 3, 4, and 7, we’ll also explore how DDoS attacks on those specific layers work.
Physical Layer (L1)
Layer 1 constitutes the hardware responsible for data transmission over physical media, like cables and switches. It’s responsible for converting digital data (usually in binary format) into physical signals so that the binary data from computers or servers can travel across networks. These signals can be in three forms:
- Electrical: Sent over a copper wire
- Light: Transmitted through an optical fiber
- Radio waves: For wireless networks
Data Link Layer (L2)
Layer 2 is responsible for node-to-node data transfer: the movement of data between individual devices (nodes) on a network. It has three tasks:
- Handling the process of moving data between individual devices, also known as “nodes”, within a network.
- Organizing data into manageable pieces known as “data packets” which can be easily sent across the network.
- Checking for any errors that might occur while data is being transferred within a single network segment and making corrections if needed.
Network Layer (L3)
L3, the network layer, organizes data into packets and adds routing information to ensure that the data can navigate through different parts of a network, known as segments. Using algorithms, it also evaluates factors such as network congestion, the number of hops (transitions from one network segment to another), and the physical distance to determine the path that will ensure the fastest and most reliable delivery of data packets to their destination.
Protecting the L3 Layer Against DDoS Attacks
To protect your organization against L3 DDoS attacks, your IT security team should focus on filtering out spoofed traffic. This involves configuring firewalls to reject packets that come with forged source IP addresses.
Such measures are important in combating IP spoofing and Smurf attacks, which amplify traffic by exploiting misconfigured network devices to flood a target with an overwhelming volume of unnecessary responses. By denying packets with fake source IP addresses, firewalls help prevent these packets from penetrating your network and thwart such attacks.
Transport Layer (L4)
Layer 4, the transport layer, ensures that data is transferred reliably and in the correct order between source and target devices. It breaks down larger data into smaller segments for easier transmission and then reassembles them at the destination. This layer also manages flow control to prevent overwhelming the receiving device, performs error checking to spot and correct any issues, and keeps track of data sequences to ensure all pieces arrive accurately and in order.
Protecting the L4 Layer Against DDoS Attacks
To protect against L4 DDoS attacks, it’s essential to control and authenticate traffic flow to prevent overload scenarios, such as SYN and UDP floods. To do so, set up thresholds that limit the number of connections any single source can attempt over a specified time frame.
Your IT security team should use handshake authentication mechanisms, like SYN cookies, to add a layer of security. SYN cookies specifically work by not allocating server resources for connections until the handshake is completed, preventing SYN flood attacks.
However, since SYN cookies involve cryptographic computations, they are often resource-intensive. To manage this without affecting server performance adversely, it can be beneficial to use proxy or delivery solutions equipped with hardware acceleration for cryptographic processes. These solutions can handle the increased computational load, ensuring that the server’s performance remains unaffected while still protecting against flood attacks at the transport layer.
Session Layer (L5)
Layer 5 manages communication sessions, which are specific exchanges of data between applications. This layer takes care of starting, maintaining, and ending these sessions, ensuring that applications can communicate for the duration needed. It also coordinates synchronization, meaning it keeps data exchange in sync during a session, ensuring messages are exchanged in an orderly manner and that sessions resume correctly after any interruption.
Presentation layer (L6)
Layer 6, the presentation layer, transforms raw data, which is data in its most basic, unprocessed form, into a format that the application layer (the top layer that interacts directly with software applications) can use. It does this by applying techniques such as encryption, which secures data by converting it into code, and compression, which reduces the size of the data for faster transmission. This process ensures that the information is both secure during transmission and efficiently sized.
Application Layer (L7)
Layer 7 interfaces between the user and the network, providing network services to applications like web browsing, file transfers, and email.
Protecting the L7 Layer Against DDoS Attacks
Web Application Firewalls (WAFs) act as security guards for web applications by filtering and monitoring traffic between a web application and the internet. Your IT security team should deploy WAFs to protect against application-specific threats to L7 such as HTTP floods and zero-day attacks, before they reach the server.
Some WAFs also offer protection against cookie crumbling attacks, which involves sending massive amounts of invalid or malformed cookies in rapid succession. This can overwhelm the server’s ability to process legitimate cookie requests, disrupting user sessions and potentially crashing the application. These WAFs can identify and block requests with suspicious cookie data formats or excessive cookie sizes.
The most common L7 DDoS attack is the GET/POST flood. It overwhelms the server with a massive number of seemingly legitimate GET or POST requests, targeting specific web pages or functionalities. These requests typically originate from botnets and appear like normal user activity, making them difficult to detect at first. To mitigate these attacks, your security team can deploy CAPTCHAs to differentiate between human users and automated bots. CAPTCHAs challenge users to complete tasks that are easy for humans but difficult for bots, preventing automated access to web services and resources. This helps to mitigate the risk of spam and brute-force attacks by ensuring that only legitimate users can submit requests or access certain online services.
Applying rate limiting controls the number of requests a user can make within a given timeframe, leading any IP address exceeding this limit to be temporarily blacklisted. This technique also helps in mitigating L7 DDoS attacks such as GET/POST floods, and ensures that resources are available for legitimate users, so your services stay online even during an attack.
Gcore Provides Multi-Layered DDoS Protection for Websites, Apps, and Servers
Gcore DDoS Protection shields websites, applications, and servers from DDoS attacks at the L3, L4, and L7 layers. It detects and mitigates attacks across network layers in real time, ensuring uninterrupted service and optimal performance of your digital assets even during an attack.
Conclusion
DDoS attacks are serious threats that can target multiple network layers to overwhelm and disrupt operations. Understanding these attacks and the specific defense mechanisms for each OSI layer equips organizations to effectively combat cybercriminals, safeguarding their reputation.
Gcore DDoS Protection is a comprehensive DDoS mitigation solution that protects against attacks on the L3, L4, and L7 layers. Put your DDoS protection in safe hands so you can focus on your core business. Gcore DDoS Protection is proven against even the most powerful, sustained, and complex attacks.
