DoS attacks attempt to consume all critical computer or network resources to make them unavailable for proper use. DoS attacks are considered a major risk because they can easily disrupt the operations of a business, and they are relatively simple to conduct. A TCP synchronization (SYN) flood attack is a classic example of a DoS attack. The TCP SYN flood attack exploits the TCP three-way handshake design by sending multiple TCP SYN packets with random source addresses to a victim host. The victim host sends a synchronization-acknowledgment (SYN-ACK) back to the random source address and adds an entry to the connection table. Because the SYN-ACK is destined for an incorrect or nonexistent host, the last part of the three-way handshake is never completed, and the entry remains in the connection table until a timer expires. By generating TCP SYN packets from random IP addresses rapidly, the attacker can fill up the connection table and deny TCP services (such as email, file transfer, or World Wide Web) to legitimate users. There is no easy way to trace the originator of the attack because the IP address of the source is forged or spoofed. An attacker creates packets with random IP source addresses with IP spoofing to obfuscate the actual originator.
DoS 攻擊企圖耗盡所有關鍵的電腦或網路資源，使其無法正常使用。DoS 攻擊被視為重大風險，因為它們很容易破壞企業運作，而且發動方式相對簡單。TCP 同步（SYN）洪水攻擊就是 DoS 攻擊的典型範例。TCP SYN 洪水攻擊利用了 TCP 三向交握的設計，向受害主機傳送大量帶有隨機來源位址的 TCP SYN 封包。受害主機會將同步確認（SYN-ACK）回傳給該隨機來源位址，並在連線表中新增一筆項目。由於該 SYN-ACK 是傳送給錯誤或不存在的主機，三向交握的最後一步永遠不會完成，該項目會一直留在連線表中，直到計時器逾時為止。攻擊者藉由快速產生來自隨機 IP 位址的 TCP SYN 封包，就能填滿連線表，使合法使用者無法使用 TCP 服務（例如電子郵件、檔案傳輸或全球資訊網）。由於來源 IP 位址是偽造或欺騙的，因此很難追查攻擊發起者。攻擊者利用 IP 欺騙（IP spoofing）建立帶有隨機 IP 來源位址的封包，藉此隱匿真正的發起者。
Some DoS attacks, such as the Ping of Death, can cause a service, system, or group of systems to crash. In Ping of Death attacks, the attacker creates a packet fragment, specifying a fragment offset indicating a full packet size of more than 65,535 bytes. 65,535 bytes is the maximum packet size as defined by the IP protocol. A vulnerable machine that receives this type of fragment will attempt to set up buffers to accommodate the packet reassembly, and the out-of-bounds request causes the system to crash or reboot. The Ping of Death exploits vulnerabilities in processing at the IP layer, but similar attacks exploit vulnerabilities at the application layer. Attackers have also exploited vulnerabilities by sending malformed Simple Network Management Protocol (SNMP), system logging (syslog), Domain Name System, or other UDP-based protocol messages. These malformed messages can cause various parsing and processing functions to fail, resulting in a system crash and a reload in most circumstances. The IPv6 Ping of Death—the IPv6 version of the original Ping of Death—was also created.
有些 DoS 攻擊，例如死亡之 ping（Ping of Death），可能導致服務、系統或一組系統當機。在死亡之 ping 攻擊中，攻擊者建立一個封包片段，並指定片段偏移量，使其表示的完整封包大小超過 65,535 位元組。65,535 位元組是 IP 協定所定義的最大封包大小。有弱點的機器收到這類片段時，會嘗試建立緩衝區以重組封包，而超出範圍的請求會導致系統當機或重新開機。死亡之 ping 利用的是 IP 層處理過程中的弱點，但類似的攻擊也會利用應用層的弱點。攻擊者也曾利用格式異常的簡易網路管理協定（SNMP）、系統記錄（syslog）、網域名稱系統，或其他以 UDP 為基礎的協定訊息來發動攻擊。這些格式異常的訊息會導致各種剖析與處理功能失效，多數情況下會造成系統當機並重新載入。之後也出現了 IPv6 死亡之 ping，也就是原始死亡之 ping 的 IPv6 版本。
Variants of the previously mentioned DoS attacks include Internet Control Message Protocol (ICMP) or UDP floods, which can slow down network operations. These attacks cause the victim to use resources such as bandwidth and system buffers to service attack requests at the expense of valid requests. ICMP flood attacks have existed for many years. In these attacks, the attacker overwhelms the targeted resource with ICMP packets such as echo request (ping) packets to saturate and slow down the victim's network infrastructure. A UDP flood attack is triggered by sending many UDP packets to the target system.
前述 DoS 攻擊的變化型包括網際網路控制訊息協定（ICMP）或 UDP 洪水攻擊，這類攻擊會拖慢網路運作。這些攻擊會讓受害端耗用頻寬與系統緩衝區等資源來處理攻擊請求，犧牲掉正常請求的服務。ICMP 洪水攻擊存在已久，攻擊者會以大量 ICMP 封包（例如回應請求／ping 封包）淹沒目標資源，使受害端的網路基礎設施飽和並變慢。UDP 洪水攻擊則是藉由向目標系統傳送大量 UDP 封包來觸發。
When a DoS attempt derives from a single host of the network, it constitutes a DoS attack. Malicious hosts can also coordinate to flood a victim with an abundance of attack packets, so that the attack takes place simultaneously from potentially thousands of sources. This type of attack is called a distributed denial of service (DDoS) attack. DDoS attacks typically emanate from networks of compromised systems that are known as botnets. In many cases, users and administrators are not even aware that their system is part of a botnet.
當 DoS 攻擊來自網路中的單一主機時，這就構成一次 DoS 攻擊。惡意主機也可以協同行動，以大量攻擊封包淹沒受害端，使攻擊同時來自成千上萬個來源，這種攻擊稱為分散式阻斷服務（DDoS）攻擊。DDoS 攻擊通常源自被稱為殭屍網路（botnet）的受駭系統網路。在許多情況下，使用者與管理員甚至不知道自己的系統已成為殭屍網路的一員。
A botnet consists of a group of "zombie" programs known as robots or bots and a main control mechanism that provides direction and control for the zombies. The originator of a botnet uses the main control mechanism on a command-and-control server to control the zombie computers remotely, often by using Internet Relay Chat (IRC) networks.
殭屍網路由一群稱為「殭屍」程式（機器人或 bot）的組成，以及一個提供指揮與控制的主要控制機制所構成。殭屍網路的發起者會在命令與控制伺服器上使用主要控制機制，通常透過網際網路中繼聊天（IRC）網路遠端操控這些殭屍電腦。
A botnet typically operates in this manner:
殭屍網路的運作方式通常如下：
- A botnet operator infects computers by infecting them with malicious code, which runs the malicious bot process. A malicious bot is a self-propagating malware designed to infect a host and connect back to the command-and-control server. In addition to its worm-like ability to self-propagate, a bot can include the ability to log keystrokes, gather passwords, capture and analyze packets, gather financial information, launch DoS attacks, relay spam, and open back doors on the infected host. Bots have all the advantages of worms but are generally much more versatile in their infection vector and are often modified within hours of publication of a new exploit. They have been known to exploit back doors opened by worms and viruses, which allows them to access networks with good perimeter control. Bots rarely announce their presence with visible actions such as high scan rates, which negatively affect the network infrastructure; instead, they infect networks in a way that escapes immediate notice.殭屍網路操控者藉由感染電腦上的惡意程式碼，讓電腦感染並執行惡意 bot 程序。惡意 bot 是一種能自我散播的惡意軟體，設計目的是感染主機並回連命令與控制伺服器。除了具備類似蠕蟲的自我散播能力外，bot 還能記錄按鍵、蒐集密碼、擷取並分析封包、蒐集財務資訊、發動 DoS 攻擊、轉發垃圾郵件，並在受感染主機上開啟後門。bot 具備蠕蟲的所有優點，但在感染途徑上通常更為多變，且常在新漏洞發布後數小時內就被修改利用。已知它們會利用蠕蟲與病毒所開啟的後門，藉此存取具備良好周邊控管的網路。bot 很少以高掃描速率等明顯行動來宣告自身存在（這類行為會對網路基礎設施造成負面影響），而是以不易被立即察覺的方式感染網路。
- The bot on the newly infected host logs into the command-and-control server and awaits commands. Often, the command-and-control server is an IRC channel or a web server.新受感染主機上的 bot 會登入命令與控制伺服器並等待指令。命令與控制伺服器通常是一個 IRC 頻道或一台網頁伺服器。
- Instructions are sent from the command-and-control server to each bot in the botnet to execute actions. When the bots receive the instructions, they begin generating malicious traffic that is aimed at the victim. Some bots also can be updated to introduce new functionalities to the bot..命令與控制伺服器會將指令傳送給殭屍網路中的每個 bot 以執行動作。bot 收到指令後，便開始產生鎖定受害端的惡意流量。有些 bot 也可以被更新，以加入新的功能。
In the example, an attacker controls the bots to launch a DDoS attack against the victim's infrastructure. These bots run a covert channel that is protected, obfuscated, or uses other security mitigation techniques, to communicate with the command-and-control server that the attacker controls. This communication often takes place over IRC, encrypted channels, bot-specific peer-to-peer networks, and even Twitter.
在此範例中，攻擊者操控這些 bot 對受害端的基礎設施發動 DDoS 攻擊。這些 bot 會執行受到保護、經過模糊化處理，或使用其他安全防護規避技術的隱蔽通道，與攻擊者所控制的命令與控制伺服器通訊。這種通訊經常透過 IRC、加密通道、bot 專屬的對等式（peer-to-peer）網路，甚至是 Twitter 進行。
