Protocol attack
A DDoS attack that exploits weaknesses in network protocols themselves, exhausting server or network equipment resources rather than raw bandwidth.
What makes this different from a volumetric flood
A protocol attack does not necessarily need enormous bandwidth. It exploits how a specific protocol, such as TCP's connection setup process, is designed to behave, exhausting connection tables or processing capacity on the target or the network equipment in front of it.
A classic example
A SYN flood sends a large number of connection initiation requests without ever completing the handshake, leaving the target holding open half-finished connections until it runs out of capacity to accept new, legitimate ones.
Frequently asked questions
Is a protocol attack harder to detect than a volumetric one?
In some ways yes, since the traffic volume itself might look modest while still exhausting a specific resource like connection table capacity, rather than saturating bandwidth outright.
Can a well-configured firewall reduce exposure to protocol attacks?
Yes, to a meaningful degree. Rate limiting new connections and enabling SYN cookies at the operating system level are common, effective mitigations for this category specifically.
Does this type of attack target the application or the infrastructure?
Mainly the infrastructure, meaning the network stack and connection-handling equipment, rather than the application logic running on top of it.
Want to see where your own server stands?
Run the free, read-only server check, or open the Security Lab and watch the detect, contain, recover, verify loop in action.
Get your free server checkOpen the Security Lab