Protecting against DDoS attacks starts with understanding the vectors attackers use. Each attack type targets a different layer of your infrastructure — and knowing them is the first step toward effective defense.
What is a DDoS attack vector?
An attack vector is the method or protocol used to overwhelm a server, network, or service. Below are the main vectors identified across our Shield Defense infrastructure.
Main attack vectors
OTHER A generic category for attacks that don't fit a specific protocol. They typically combine multiple techniques to hinder automatic mitigation.
TCP SYN Flood Exploits the TCP handshake by sending massive SYN packets without completing the connection. The server waits for responses that never arrive, exhausting available resources.
TCP RST Sends forged reset packets to terminate legitimate connections. The goal is to drop active sessions between users and servers.
TCP FIN Similar to RST, uses FIN packets to abruptly close connections. Effective against services that maintain persistent sessions.
TCP ACK Flood Floods the server with out-of-context ACK packets. Since the server must process each packet to discard it, CPU and memory consumption rise quickly.
TCP NULL TCP packets with no flags set. Many operating systems respond unexpectedly to these packets, exposing vulnerabilities in network stacks.
DNS Amplification Uses open DNS resolvers to amplify attack traffic. A small query generates a much larger response directed at the victim — resulting in high-volume traffic with minimal effort from the attacker.
UDP Flood UDP packets are sent in bulk to random ports. The server wastes resources checking which application should receive each packet, potentially becoming unavailable quickly.
ICMP Flood Known as a "ping flood," it overwhelms the target with ICMP echo requests. Simple but still effective against infrastructure without proper mitigation.
Fragment Attack Exploits IP packet fragmentation. Malformed or incomplete fragments force the server to keep buffers open awaiting reassembly, consuming memory and processing power.
Bogon Flood Uses bogon IP addresses — reserved, non-routable, or officially unallocated blocks — to originate attack traffic. Since these addresses should never appear on the public internet, they are used to disguise the attack's origin and hinder tracing. Bogon filtering is an essential perimeter defense layer.
How LinusHost protects your infrastructure
Our Shield Defense protection layer, integrated across our entire infrastructure in Brazil and Canada, automatically identifies and mitigates these vectors — with no impact on legitimate users and no manual configuration required.
Mitigation happens at the network edge, before malicious traffic reaches your servers, ensuring continuous availability even under attack.