Layer 4 and Layer 7 DDoS Attacks: Detection and Protection

DDoS (Distributed Denial of Service) attacks aim to take your server or network offline by overwhelming it with excessive traffic. These attacks occur at different layers of the OSI model. This guide covers Layer 4 (Transport) and Layer 7 (Application) attack types, detection methods, and protection strategies.

REXE infrastructure provides network-level protection against Layer 3/4 attacks through Path Panel. For Layer 7 protection, Cloudflare WAF or custom configurations can be used.

OSI Model and DDoS Layers

Layer	Name	Attack Types	Target
Layer 3	Network	IP flood, ICMP flood	Network bandwidth
Layer 4	Transport	SYN flood, UDP flood, TCP flood	Connection table
Layer 7	Application	HTTP flood, Slowloris, DNS query	Application resources

Layer 4 Attacks

Layer 4 attacks target TCP and UDP protocols to exhaust server connection resources.

SYN Flood

Exploits the TCP three-way handshake process. The attacker sends numerous SYN packets but never responds with ACK.

Normal TCP Connection:
Client → SYN → Server
Client ← SYN-ACK ← Server
Client → ACK → Server
✓ Connection established

SYN Flood:
Attacker → SYN → Server
Attacker ← SYN-ACK ← Server
Attacker → (never sends ACK)
✗ Half-open connections accumulate

SYN Flood Detection

hljs bash

# Check half-open connections
ss -s
# Watch for SYN-RECV connection count

# List SYN-RECV connections
ss -tnp state syn-recv

# Connection state distribution
ss -ant | awk '{print $1}' | sort | uniq -c | sort -rn

# SYN count by source IP
ss -tnp state syn-recv | awk '{print $4}' | cut -d: -f1 | sort | uniq -c | sort -rn | head -20

SYN Flood Protection

hljs bash

# Enable SYN cookies
sudo sysctl -w net.ipv4.tcp_syncookies=1

# Increase SYN backlog
sudo sysctl -w net.ipv4.tcp_max_syn_backlog=65536

# Reduce SYN-ACK retry count
sudo sysctl -w net.ipv4.tcp_synack_retries=2

# Make persistent
cat >> /etc/sysctl.conf << 'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_synack_retries = 2
net.ipv4.tcp_syn_retries = 2
net.core.somaxconn = 65536
EOF
sudo sysctl -p

UDP Flood

Since UDP is a connectionless protocol, large amounts of UDP packets can be sent with spoofed source IPs.

hljs bash

# Monitor UDP traffic
sudo tcpdump -i eth0 udp -c 1000 -nn

# Check UDP packet count
sudo iptables -L -v -n | grep udp

UDP Flood Protection

hljs bash

# Close unnecessary UDP ports
sudo iptables -A INPUT -p udp --dport 19 -j DROP   # chargen
sudo iptables -A INPUT -p udp --dport 69 -j DROP   # TFTP
sudo iptables -A INPUT -p udp --dport 111 -j DROP  # portmap
sudo iptables -A INPUT -p udp --dport 161 -j DROP  # SNMP

# UDP rate limiting
sudo iptables -A INPUT -p udp -m limit --limit 100/s --limit-burst 200 -j ACCEPT
sudo iptables -A INPUT -p udp -j DROP

Amplification Attacks

The attacker sends small requests to generate large responses, using the victim's IP as the source.

Protocol	Amplification Factor	Port
DNS	28-54x	53
NTP	556x	123
Memcached	51000x	11211
SSDP	30x	1900

hljs bash

# Disable NTP monlist
echo "disable monitor" >> /etc/ntp.conf
sudo systemctl restart ntpd

# Bind Memcached to localhost only
echo "-l 127.0.0.1" >> /etc/memcached.conf
sudo systemctl restart memcached

Layer 7 Attacks

Layer 7 attacks target the HTTP/HTTPS protocol to exhaust web server application resources. These attacks are harder to detect as they resemble legitimate traffic.

HTTP Flood

Overloads the web server by sending numerous HTTP GET or POST requests.

hljs bash

# Monitor HTTP request count (Nginx)
tail -f /var/log/nginx/access.log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20

# Requests per second
awk '{print $4}' /var/log/nginx/access.log | cut -d: -f1-3 | sort | uniq -c | sort -rn | head -10

# Most requested URLs
awk '{print $7}' /var/log/nginx/access.log | sort | uniq -c | sort -rn | head -20

HTTP Flood Protection (Nginx)

hljs nginx

# /etc/nginx/conf.d/rate-limit.conf
limit_req_zone $binary_remote_addr zone=general:10m rate=10r/s;
limit_req_zone $binary_remote_addr zone=api:10m rate=5r/s;
limit_conn_zone $binary_remote_addr zone=addr:10m;

server {
    limit_req zone=general burst=20 nodelay;
    limit_conn addr 50;
    
    location /api/ {
        limit_req zone=api burst=10 nodelay;
    }
}

Slowloris

Slowloris exhausts the server's connection pool by keeping HTTP connections open as long as possible.

Slowloris Protection (Nginx)

hljs nginx

http {
    client_header_timeout 10s;
    client_body_timeout 10s;
    send_timeout 10s;
    keepalive_timeout 15s;
    
    limit_conn_zone $binary_remote_addr zone=conn:10m;
    limit_conn conn 20;
}

General Protection Strategies

Kernel Parameter Optimization

hljs bash

# /etc/sysctl.conf - DDoS protection parameters
cat >> /etc/sysctl.conf << 'EOF'
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 65536
net.ipv4.tcp_synack_retries = 2
net.netfilter.nf_conntrack_max = 1000000
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.netdev_max_backlog = 65536
net.core.somaxconn = 65536
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.rp_filter = 1
EOF
sudo sysctl -p

DDoS Protection with iptables

hljs bash

#!/bin/bash
# Drop invalid packets
iptables -A INPUT -m state --state INVALID -j DROP

# SYN check for new connections
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP

# Drop XMAS packets
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP

# Drop NULL packets
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP

# SYN flood protection
iptables -A INPUT -p tcp --syn -m limit --limit 100/s --limit-burst 200 -j ACCEPT

# Per-IP connection limit
iptables -A INPUT -p tcp --dport 80 -m connlimit --connlimit-above 50 -j DROP
iptables -A INPUT -p tcp --dport 443 -m connlimit --connlimit-above 50 -j DROP

Conclusion

Layer 4 and Layer 7 DDoS attacks require different strategies. Layer 4 attacks are blocked at the network level (Path Panel, iptables), while Layer 7 attacks are filtered at the application level (rate limiting, WAF, Cloudflare). A multi-layered protection approach provides the most effective defense.

Layer 4 and Layer 7 DDoS Attacks: Detection and Protection

Table of Contents