Member Avatar for s.w.a

please i need to know what can be the ratio of the attackers packets at the server in the case of DDoS attack and i couldn't find it
thank you in advance for any help

  • 2 Contributors
  • 3 Replies
  • 185 Views
  • 1 Week Discussion Span
  • Latest Post Latest Post by nalawar

Dani AI

Generated

Short answer for : there is no single, fixed "attack ratio." What matters is the attack rate (pps or bps) relative to the resource you want to exhaust (link bandwidth, kernel accept queue, application threads). ’s point that a server may end up only servicing attack traffic is true in the outcome, but it is not a universal 100% packet-ratio on the wire — that depends on topology, routing and where packets are dropped.

A simple model for SYN floods (useful to estimate a required SYN/sec): let B = listen backlog slots, T = average time a half-open entry holds (seconds), and R_legit = legitimate SYNs/sec. Rough approximation:

R_required_syn_per_s = max(0, B / T - R_legit)

Example (illustrative): if B=256 and T=60s then B/T ≈ 4.3 SYN/s; with 1 legitimate SYN/s an attacker only needs ~3.3 SYN/s to keep the backlog occupied. Real systems vary (SYN cookies, different timeouts, OS tuning), so treat numbers as an estimate.

For link-saturation attacks use bandwidth math:

attack_bps_needed > link_capacity_bps - legitimate_bps

Also remember pps vs bps: lots of small packets raise packet-processing load (CPU, interrupts), whereas large packets consume bandwidth.

Practical steps to measure and defend: monitor pps and bps at your interface and the number of half-open connections (ss / netstat), capture samples with tcpdump to confirm flags, and check kernel knobs (SYN cookies, backlog). Mitigations include SYN cookies / SYN proxy, rate-limiting at firewall, connection limits per IP, and upstream/ISP scrubbing or CDN protection for volumetric attacks. Use the simple formulas above with your actual B, T, link and legitimate rates to estimate the attacker rate required in your environment.

Recommended Answers

All 3 Replies

Member Avatar for nalawar

Hello,

Please can you explain more what do you mean by attacker ratio?

If you were under a DDOS attack, you will keep getting syn packages until your network is congested and your computer will not be responding at all.

So, the ratio of the syn Packets you receive will be around 100%.

If you can explain more, I might be able to help you better.

Member Avatar for s.w.a

hello, thank you very much for your reply
i want to know what is the ratio that the attackers send in, to be able to exhust the server queue?


and at the server you mean it will be 100% and the legitimate packets not there is that what you mean please?
thanks with regards

Edited by s.w.a because: n/a
Member Avatar for nalawar

Hello,

Well, this article might be helpful,

Concerning the 100%, The server will be serving only the packets of the DDOS attack (syn packages), thus all other packages will be discarded.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.