What is DoS?

Denial of Service (DoS) is an attack that attempts to disrupt network services and deny access to legitimate users by overwhelming a target with unnecessary traffic from one or more sources, exhausting its hardware and software resources until it can no longer respond.

Key takeaways

• A DoS attack floods a target with traffic until it exhausts its resources.
• Attacks target bandwidth, connection state, or application processing.
• DDoS attacks launch the same flood from many distributed sources at once.
• Versa DoS policies match traffic by zone, address, protocol, and time.
• Profiles set packet-per-second thresholds and drop, alert, or rate-limit.

On this page: Why it matters · How it works · Types · DoS & Versa · FAQ

Why is DoS important?

A single successful DoS attack can take a customer-facing application, VPN gateway, or an entire branch office offline for as long as the flood continues, and every minute of downtime translates directly into lost revenue, missed transactions, and support tickets. Because the goal is exhaustion rather than data theft, a DoS attack doesn’t require breaching a firewall or stealing credentials – it only needs to send more traffic, sessions, or malformed packets than a target can process, which puts every internet-facing service at risk regardless of how well its access controls are configured.

The threat has also become cheaper and easier to launch. Botnets-for-hire and reflection techniques let an attacker generate traffic volumes that dwarf what a single source could produce, while application-layer floods can overwhelm a server with a comparatively small number of well-crafted requests. For network and security teams, DoS protection is a baseline control, not an optional add-on: it has to sit inline, distinguish attack traffic from legitimate bursts, and respond automatically, because a human-paced response is too slow once a flood is already underway.

What is DoS?

Every DoS technique aims at the same outcome – exhausting a resource the target needs to keep serving legitimate users – but reaches it in different ways. Some floods target raw bandwidth, saturating a link so nothing else gets through. Others target a device’s session table or CPU: opening large numbers of TCP sessions and never completing them, scanning ports, sweeping a subnet’s hosts, or sending malformed or oversized packets designed to consume more processing than they should. A resource-constrained device – a small branch firewall, an IoT gateway – can be knocked offline by traffic volumes a data-center appliance would absorb without noticing, which is why protection has to be sized to what the specific device or link can actually handle.

Detecting an attack in progress means comparing live traffic against expected baselines, per protocol and often per source or destination address, so a burst that looks like a flood to a small server doesn’t need to look like one to a large one. Once a rate threshold is crossed, the response is typically automatic: alert, rate-limit the offending flow, or drop packets outright – because by the time a person is paged, the resource under attack may already be exhausted.

Types of DoS

DoS attacks are commonly grouped by which layer of the stack they target. Volumetric attacks – traffic floods and reflection/amplification techniques that abuse protocols like DNS or NTP to multiply an attacker’s traffic – saturate available bandwidth so no capacity remains for legitimate connections. Protocol attacks exploit how network and transport-layer protocols allocate state; a TCP SYN flood opens large numbers of half-open connections to exhaust a target’s connection table without completing a single handshake. Application-layer attacks send a comparatively low volume of legitimate-looking requests – an HTTP GET flood, or a deliberately slow request – that are cheap to send but expensive for the application to process, which makes them harder to distinguish from a real traffic spike.

Any of these can be launched from a single source (a DoS attack) or from many distributed sources at once, typically a botnet – a Distributed Denial of Service (DDoS) attack. Distribution is now the norm: it multiplies available attack volume and makes source-based blocking far less effective, since there’s no single address to filter.

DoS & Versa

Versa builds DoS protection directly into VOS as a policy-plus-profile pair. A DoS protection profile sets per-protocol thresholds – for ICMP, ICMPv6, TCP, UDP, SCTP, and other IP traffic – as an alarm rate, an active (response) rate, and a maximal rate, each in packets per second, plus the action taken once the active rate is breached: random early drops or TCP SYN cookies. Profiles come in two forms: an aggregate profile applies one shared threshold to all matching traffic, suited to subnet-wide floods from many source IPs; a classified profile tracks thresholds per source IP, per destination IP, or both, suited to attacks aimed at a specific endpoint. A DoS policy matches incoming traffic by source and destination zone, address, IP header fields, TCP/UDP service, and time of day, then applies Allow, Deny, or Protect – the profile-driven mitigation – to whatever matches.

This is configured under Services > Next-Gen Firewall (or Stateful Firewall) > DoS in Versa Director, and under Security > Denial of Service (DoS) Policy for cloud firewall deployments managed through Concerto, which requires a secure application optimization or advanced security license. Matched traffic and threshold breaches log to Versa Analytics, with a dedicated DoS dashboard for drilling into top threats. See Configure DoS Protection, Configure DoS Protection (NGFW), and Configure Security for the full configuration reference.

Frequently asked questions

What is the difference between DoS and DDoS?

A DoS attack originates from a single source; a Distributed Denial of Service (DDoS) attack floods a target from many sources at once, usually a botnet. DDoS is harder to block because there’s no single address to filter, and it generates far larger attack volumes than one machine alone.

What’s the difference between a DoS attack and a data breach?

A DoS attack targets availability – knocking a service offline – not data confidentiality or integrity, which is what a breach compromises. The two aren’t mutually exclusive: some attackers use a DoS flood as a distraction while a separate intrusion runs elsewhere.

Can a firewall stop a DoS attack on its own?

A standard firewall filters by rule – port, address, application – but doesn’t rate-limit floods by itself; high-volume traffic can exhaust its session table before rules even apply. Purpose-built DoS profiles add the rate thresholds and classification a firewall alone lacks.

What is a SYN flood?

A SYN flood is a protocol-layer DoS attack that opens large numbers of TCP connections and never completes the handshake, filling a target’s connection table with half-open sessions until it can’t accept legitimate ones. SYN cookies are the standard mitigation.

Does DoS protection affect legitimate traffic?

Well-tuned DoS protection shouldn’t, since profiles set thresholds above normal traffic patterns and act only once a rate is exceeded. Because it’s resource-intensive, best practice is enabling it selectively – on critical systems and the subnets that actually need it, not everywhere by default.

More on DoS

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about DoS, these are worth looking at next.