{"id":30574,"date":"2024-10-15T07:30:19","date_gmt":"2024-10-15T07:30:19","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=30574"},"modified":"2026-04-17T18:07:37","modified_gmt":"2026-04-17T18:07:37","slug":"a-deep-dive-into-ddos-carpet-bombing-attacks","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/a-deep-dive-into-ddos-carpet-bombing-attacks\/","title":{"rendered":"A Deep Dive into DDoS Carpet-Bombing Attacks"},"content":{"rendered":"\n

With the rapid growth of the internet, especially in areas like cloud computing, 5G, and IoT technologies, the scale of botnets continues to expand, intensifying the battle between attack and defense. In response, DDoS attacks have evolved, taking on a more intelligent form to evade security defenses.<\/p>\n\n\n\n

Traditional DDoS attacks typically target specific services—either a single IP address or a small group of IP addresses—resulting in a sudden increase in traffic or connection attempts. The attack characteristics are often quite obvious. However, as the internet continues to evolve, the DDoS threat landscape has escalated. Attackers now increasingly target internet data centers (IDCs), ISPs, or enterprises with a large number of IP addresses using carpet-bombing attacks.<\/p>\n\n\n\n

In a carpet-bombing attack, instead of launching a DDoS flood attack against a single IP or a few IPs, attackers simultaneously or sequentially target many IP addresses. In simultaneous attacks, the traffic directed at each IP is relatively small but, when combined, it exceeds the overall bandwidth. During sequential attacks, each IP suffers a large attack but only for a very short duration.<\/p>\n\n\n\n

Most current DDoS detection methods focus on traffic changes for individual IPs or detect high-traffic IPs when overall traffic exceeds limits. However, carpet-bombing attacks can evade these traditional detection and defense methods, presenting new challenges to DDoS defense.<\/p>\n\n\n\n

How Carpet-Bombing Attacks Work<\/h2>\n\n\n\n

From the Attacker’s Perspective<\/strong> <\/h3>\n\n\n\n

Attackers often acquire the target’s network address range through various methods. When analyzing the Mirai botnet code, it’s clear that when the attack target is specified as a network segment, the target IP for each attack is randomly selected from that range.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 1: Mirai carpet-bombing code<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

This shows that the target is no longer a fixed IP address, but a group of addresses receiving attack traffic.<\/p>\n\n\n\n

From the Victim’s Perspective<\/strong> <\/h3>\n\n\n\n

The victim experiences a noticeable increase in overall network traffic (or a specific type of traffic), but no single IP address shows abnormal traffic. The increased traffic is distributed across multiple IP addresses, leading to link congestion or anomalies in session tables of back-end firewalls or security devices, affecting network quality.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 2: Schematic Diagram of increased traffic distribution<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

From the Defender’s Perspective <\/strong><\/h3>\n\n\n\n

Compared to traditional single-IP attacks, carpet-bombing attacks distribute traffic across multiple IP addresses.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 3: Attack traffic targeting a single IP address vs. carpet-bombing traffic<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Defenders typically focus on attacks targeting single IPs, leading to missed detections or inadequate defenses for carpet-bombing attacks.<\/p>\n\n\n\n

Real-World Carpet-Bombing Attack Cases    <\/h2>\n\n\n\n

SYN Flood Carpet-Bombing Attack<\/strong><\/h3>\n\n\n\n

An organization experienced a carpet-bombing attack from a fixed source IP through SYN packets, causing the back-end firewall’s concurrent session limit to be exceeded, resulting in service disruption.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 4: Carpet-bombing attacks from a fixed attack source<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

ISP NTP Amplification Carpet-Bombing Attack<\/strong><\/h3>\n\n\n\n

An Internet Service Provider (ISP) faced an NTP reflection amplification carpet-bombing attack, which led to link congestion and reduced network quality.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 5: NTP amplification carpet-bombing attack<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Defending Against Carpet-Bombing Attacks<\/h2>\n\n\n\n

A typical out-of-the-path DDoS deployment involves traffic detection, diversion, and scrubbing.<\/p>\n\n\n

\n
\"Red<\/a>
Figure 6: Typical deployment for DDoS protection<\/figcaption><\/figure>\n<\/div>\n\n\n

<\/p>\n\n\n\n

Traffic Detection:<\/strong>
Traditional detection methods focus on anomalies in individual IPs or overall traffic volumes. However, targeted low-speed carpet-bombing attacks may go undetected. For example, a low-speed SYN Flood carpet-bombing could cause firewall anomalies, so detection mechanisms must support more granular, network segment-based attack type detection.<\/p>\n\n\n\n

Additionally, since single IP attacks may also trigger subnet alerts, a more comprehensive detection model is needed to improve the accuracy of carpet-bombing attack detection. For example, when triggering a subnet alert, it is necessary to detect the traffic proportion of the Top IP addresses or to detect in conjunction whether there is any single IP attack alert triggered, etc.<\/p>\n\n\n\n

Traffic Diversion:<\/strong>
Most DDoS defenses use BGP diversion. During a carpet-bombing attack, the traditional single-IP diversion method is slow and increases the number of routing entries. Using network segment diversion helps, but large segments can sometimes cause routing issues due to the longest prefix match rule. For effective traffic diversion, routing splits should be supported. For example, a \/24 network should be split into multiple routes with \/26 masks.<\/p>\n\n\n\n

Traffic Scrubbing:<\/strong>
In addition to traditional scrubbing thresholds for individual IPs, network segment-based scrubbing strategies should be implemented. Two key scenarios must be addressed:<\/p>\n\n\n\n