# What Are Layer 3 and Layer 4 DDoS Attacks? SYN Flood, UDP Flood and Network Layer Risks

**URL:** https://securesys.com.tr/en/learning/ddos-simulation/layer-3-and-layer-4-ddos-attacks

![What Are Layer 3 and Layer 4 DDoS Attacks? SYN Flood, UDP Flood and Network Layer Risks](/images/bilgi-merkezi/covers/cover-ddos-04.webp)

An organisation's web application may be technically entirely healthy.

The servers may be running.

The database may be up.

The application may be responding without errors.

But if the network layer cannot respond because of heavy attack traffic, the result for the user is the same:

**The service becomes unreachable.**

That is where the fundamental impact of layer 3 and layer 4 DDoS attacks appears.

These attacks do not have to target the application's internal logic. Instead they try to consume network and transport layer resources such as;

- the internet connection,
- routers,
- the firewall,
- the load balancer,
- the connection table,
- packet processing capacity,
- TCP/UDP services.

All of them finite.

Concepts such as **layer 3 DDoS, layer 4 DDoS, SYN flood, UDP flood, TCP flood, PPS, CPS, firewall session exhaustion and anti-DDoS** are therefore fundamental parts of corporate DDoS security.

The real question is this:

#### What happens if it is your network under attack, not your application?

#### What Is Layer 3 DDoS?

**Layer 3 DDoS** refers to DDoS attacks targeting the network layer of the OSI model.

The core task of that layer is carrying IP packets between networks.

At layer 3 the attacker's target may be;

the IP infrastructure,

network bandwidth,

router capacity,

packet processing capability.

In attacks of this kind, the technology the application is written in is usually irrelevant.

The web application may be Java, .NET, PHP or Node.js.

The attack can exhaust the network layer before it ever reaches the application code.

**Upstream DDoS protection and network-level mitigation** are therefore important in fighting L3 DDoS attacks.

### What Is Layer 4 DDoS?

**Layer 4 DDoS** refers to attacks targeting services and protocols at the transport layer of the OSI model.

The most important protocols at this level can be thought of as;

#### TCP

and

#### UDP

together.

In layer 4 attacks the target may be components such as;

connection state,

sockets,

the session table,

firewall resources,

load balancer capacity,

the server network stack.

One of the best-known layer 4 attacks is the **SYN flood**.

### What Is the Difference Between Layer 3 and Layer 4?

Layer 3 and layer 4 DDoS attacks are usually handled under the same heading.

But there is a difference in the resource they target.

#### Layer 3

Works at the IP and network routing level.

#### Layer 4

Works at the TCP/UDP and connection management level.

In the corporate world many anti-DDoS services offer these two layers together as:

#### L3/L4 DDoS Protection

a single package.

Seeing the two concepts together in technical documentation is therefore very common.

### What Is a SYN Flood?

A **SYN flood** is one of the best-known DDoS attacks targeting the TCP connection mechanism.

Before TCP communication begins, a three-stage connection process takes place.

This structure is called:

#### The TCP Three-Way Handshake

and works as follows.

The general process is:

#### \1. SYN

The client sends a connection request to the server.

#### \2. SYN-ACK

The server responds to the request.

#### \3. ACK

The client completes the connection.

In a SYN flood attack, large numbers of new connections are initiated but not all of them are completed normally.

The server or security device may keep allocating resources for these connections.

The result is a large number of **half-open connections**.

### Why Does a SYN Flood Cause a Service Outage?

The number of connections a system can hold at once is not unlimited.

The firewall,

the load balancer,

the operating system

can each hold a certain amount of connection state in memory.

If the attacker generates very high volumes of SYN traffic, those resources can be exhausted.

The result is that new TCP connections from genuine users may not be accepted.

The real impact of the attack should therefore not be measured by traffic volume alone.

These metrics matter too:

#### SYN PPS

#### Half-Open Connections

#### Connection Table Usage

#### CPU

#### Memory

#### TCP Timeout

### Why Does the TCP Three-Way Handshake Matter for DDoS Security?

TCP is a stateful protocol.

In other words, the state of the connection is tracked.

That is necessary for normal communication.

But the same characteristic can be abused by an attacker to consume resources.

If a firewall also works statefully, it can create state table entries for incoming connections.

A SYN flood can therefore affect not only the server but the security device in front of it.

In DDoS testing, therefore, not only backend server performance but also **firewall state table capacity** must be measured.

### What Are SYN Cookies?

One of the defensive methods used against SYN flood attacks is the **SYN cookies** approach.

The aim is to reduce the unnecessary state the server holds before a connection is completed.

The resource consumption created by large numbers of half-open connections can thereby be limited.

But SYN cookies alone do not solve every layer 4 DDoS attack.

Because if the attack creates;

very high PPS,

firewall saturation,

upstream bandwidth exhaustion,

the problem appears elsewhere.

### What Is a SYN Proxy?

Some firewalls and anti-DDoS systems use mechanisms similar to a **SYN proxy**.

Here the security device manages the initial TCP handshake process with the client itself.

Once satisfied the connection is genuine, it forwards it to the backend system.

This approach can reduce the number of fake or incomplete connections reaching the server.

But at high attack volumes the security device's own capacity must also be assessed.

### What Is a TCP Connection Flood?

A SYN flood targets the first stage of the connection.

A **TCP connection flood**, by contrast, aims to consume resources by completing large numbers of genuine TCP connections.

In this case the connections may be fully established.

SYN flood protection alone may therefore not be enough.

The target may be resources such as;

concurrent connections,

server workers,

load balancer capacity,

application sockets.

A DDoS defence must therefore not automatically treat a completed connection as trustworthy.

### What Is an ACK Flood?

An **ACK flood** is a layer 4 attack approach carried out by sending heavy volumes of ACK packets at the target.

A stateful firewall tries to check whether the incoming ACK packet belongs to a valid connection.

At high PPS levels that operation can consume resources.

Firewall capacity should therefore not be assessed by:

#### Gbps

alone.

A firewall may support 20 Gbps of throughput.

But under a very high PPS attack made up of small packets it can reach its resource limit far sooner.

### What Is an RST Flood?

**RST** is one of the flags used to terminate TCP connections.

Heavy RST traffic can create resource consumption on certain systems or devices.

The basic approach in corporate DDoS analysis is not to memorise individual attack names but to ask this question:

#### Which network resource is this traffic consuming?

This approach leads to a better-designed defence.

### What Is a UDP Flood?

A **UDP flood** is one of the attack types commonly seen at layer 4.

UDP is a connectionless protocol.

There is no three-way handshake as in TCP.

That characteristic makes it easier for the attacker to generate large numbers of packets.

During a UDP flood, heavy volumes of UDP packets can be sent at the target.

The aim may be to consume;

network bandwidth,

packet processing,

the firewall,

routers,

server resources.

### Why Is a UDP Flood Dangerous?

Because UDP is connectionless, the attacker can reach very high PPS levels.

And when small packets are used, bandwidth can look relatively low while the packet rate is extremely high.

Compare two attacks, for example:

#### Attack A

10 Gbps

500,000 PPS

#### Attack B

5 Gbps

8 million PPS

The second attack generates lower bandwidth yet can create a far heavier impact on the firewall or router.

DDoS capacity should therefore not be measured in Gbps alone.

### What Is PPS?

**Packets per second (PPS)** expresses the number of packets processed per second.

It is one of the most important capacity indicators for network devices.

A firewall may have;

a high bandwidth capacity.

But a high-PPS attack made up of very small packets can push the device to its packet processing limit.

When assessing anti-DDoS and firewalls, therefore:

#### Gbps + PPS

must be examined together.

### What Is CPS?

**Connections per second (CPS)** expresses the number of new connections created per second.

It is an important capacity metric for stateful firewalls and load balancers in particular.

A device may be able to hold millions of concurrent connections.

But the number of new connections it can create per second may be far lower.

In attacks such as SYN floods and TCP connection floods, the CPS level therefore becomes critical.

### What Are Concurrent Connections?

**Concurrent connections** expresses the total number of connections active at the same time.

A firewall may support;

5 million concurrent connections.

But the real capacity can be affected by features such as;

the traffic profile,

packet size,

NAT,

IPS,

SSL inspection,

logging.

The maximum figures on a vendor datasheet are therefore not the only indicator of real DDoS resilience.

### What Is a Firewall Session Table?

Stateful firewalls use a **session table** to track active connections.

For each connection, information such as;

source IP,

destination IP,

source port,

destination port,

protocol,

state

can be held.

An attacker can try to exhaust the session table by creating large numbers of connections.

This can be assessed as **session exhaustion**.

When the session table fills, new genuine user connections may not be created.

### Can the Firewall Be the Bottleneck in a DDoS Attack?

Yes.

One of the important mistakes organisations make is seeing the firewall only as a security control.

But the firewall is also a network device with limited capacity.

During a DDoS attack;

CPU,

memory,

the session table,

the NAT table,

packet processing,

logging

resources can all be consumed.

Where IPS, SSL inspection or heavy logging are active in particular, the device's real capacity changes.

Firewall telemetry must therefore always be monitored during controlled DDoS tests.

### What Is NAT Table Exhaustion?

**Network address translation (NAT)** is used in many corporate networks.

Connection states must be tracked during NAT operations.

Large numbers of connections can cause NAT resources to be exhausted.

A DDoS attack can therefore affect not the backend directly but the firewall or router performing NAT.

The critical question here is:

#### Which resource runs out first during the attack?

Finding that out is the core purpose of DDoS resilience analysis.

### How Do Amplification Attacks Relate to L3/L4 DDoS?

Reflection and amplification attacks are generally used to generate high-volume traffic at the network level.

The attacker can direct traffic at the target by making use of third-party systems on the internet.

Amplification behaviour can be seen through;

DNS,

NTP

and various other UDP services abused historically.

These attacks matter particularly for volumetric DDoS capacity.

### What Is IP Spoofing?

**IP spoofing** is the falsification of a packet's source IP address.

It is one of the fundamental components of reflection attacks.

The attacker writes the victim's address into the source IP field of the query they send.

The third-party service sends its response not to the attacker but to the victim.

The source IP addresses of incoming DDoS traffic may therefore not point to the real attacker systems.

### What Is BCP38 and How Does It Relate to DDoS?

Applying source IP verification mechanisms on the internet service provider side can help reduce spoofed traffic.

This approach is generally associated with the concepts of **BCP38 / network ingress filtering**.

The aim is to block packets with a spoofed source IP that could not legitimately originate from a network.

As such measures become more widespread, carrying out reflection/amplification attacks becomes harder.

But because they are not applied at the same level across all internet infrastructure, the risk does not disappear entirely.

### Why Do MTU and Packet Size Matter in DDoS Testing?

The impact of a DDoS attack does not come from total traffic volume alone.

Packet size matters too.

Large packets consume bandwidth faster.

Small packets create higher PPS and strain the processing capacity of network devices.

Assessing different packet sizes in DDoS testing is therefore useful.

For example:

#### Large Packet Attack

brings bandwidth consumption to the fore.

#### Small Packet Flood

targets packet processing capacity.

### Can a System Fail Without High Gbps?

Yes.

This is one of the most important points in DDoS security.

The company may have a 10 Gbps connection.

The attack may be only 2 Gbps.

At first glance the capacity looks sufficient.

But if the attack generates 15 million PPS, the firewall's packet processing capacity can be exhausted.

The result:

The internet link is not full.

But the service is still unreachable.

It is therefore necessary to think of it as:

#### Bandwidth capacity ≠ DDoS capacity

### Why Does the ISP Matter in DDoS Protection?

If attack traffic in a volumetric DDoS attack is filling the organisation's internet link, measures taken internally can be inadequate.

The attack must then be filtered at the upstream level.

The ISP can provide mechanisms such as;

blackholing,

traffic diversion,

scrubbing,

rate limiting.

ISP communication processes must therefore be defined in advance in the DDoS incident response plan.

### What Is RTBH?

**Remotely triggered black hole (RTBH)** is one of the network mitigation methods that can be used in serious DDoS attacks.

Traffic destined for a particular target can be routed into a black hole at the upstream level.

This method can prevent attack traffic from consuming the network infrastructure.

But it has an important disadvantage:

**Legitimate traffic cannot reach the target either.**

RTBH is therefore usually considered a last resort.

The aim may be to protect the organisation's other infrastructure from the attack's impact.

### What Is BGP FlowSpec?

**BGP FlowSpec** is one of the mechanisms allowing network operators to distribute filtering policies for particular traffic patterns.

Traffic filters can be applied according to characteristics such as;

source,

destination,

protocol,

port.

It can form part of network-based mitigation processes in large service provider and anti-DDoS architectures.

### How Does a Scrubbing Centre Work Against L3/L4 Attacks?

A scrubbing centre aims to analyse and clean attack traffic before it reaches the organisation's infrastructure.

The general flow can be as follows:

#### Internet

↓

#### DDoS Traffic Detection

↓

#### Traffic Diversion

↓

#### Scrubbing Centre

↓

**Malicious traffic → dropped**

**Legitimate traffic → customer**

This model matters particularly in volumetric and L3/L4 attacks.

Because it helps prevent the organisation's internet link filling with attack traffic.

### How Is Traffic Diversion Carried Out?

During DDoS mitigation, traffic can be directed to the scrubbing infrastructure by various methods.

Depending on the architecture, approaches such as;

BGP routing,

DNS-based routing,

a cloud proxy,

anycast

can be used.

The most important issue here is the diversion time.

If it takes minutes to route traffic to the scrubbing centre after the attack starts, a service outage can occur throughout that period.

**Time to mitigate (TTM)** is therefore a critical metric.

### Always-On vs On-Demand L3/L4 Protection

In the **always-on** model, traffic passes continuously through the anti-DDoS infrastructure.

That provides the advantage of a faster response to attack.

In the **on-demand** model, normal traffic comes directly to the organisation.

When an anomaly is detected, traffic is diverted to the scrubbing service.

In the on-demand approach the times for;

detection,

notification,

route diversion

matter.

Which model is more suitable must be determined by the organisation's risk and latency requirements.

### How Is Anycast Used in DDoS Protection?

**Anycast** is a network architecture allowing the same IP address to be announced from different geographic points.

User traffic is generally routed to the most suitable or nearest point.

Its advantage for DDoS is that attack traffic can be spread across a wide distributed infrastructure rather than concentrating on a single data centre.

Large CDN and cloud DDoS providers therefore make use of anycast architectures.

But anycast is not an attack cleaning mechanism on its own.

It provides distributed capacity.

### Why Is the Load Balancer Critical in a DDoS Attack?

A load balancer distributes application traffic across different backend systems.

But the load balancer also has limits such as;

connection capacity,

CPS,

throughput,

CPU.

The attacker can create resource consumption targeting the load balancer before the backends.

Load balancer capacity must therefore be assessed separately in DDoS testing.

### What Do Network ACLs Do in DDoS Protection?

Network access control lists can be used to filter traffic by;

IP,

protocol,

port.

They can be useful against clear attack patterns.

But a static ACL approach may not be enough on its own against attacks from distributed and spoofed sources.

Very broad ACL rules can also affect legitimate traffic.

Automated DDoS mitigation mechanisms can therefore provide more dynamic behavioural analysis.

### Is Geo-Blocking Effective Against DDoS?

In some cases most of the attack traffic comes from regions where the organisation has no customers at all.

Temporary **geo-blocking** can then be considered.

But it must be applied carefully.

Factors such as;

VPNs,

mobile operators,

global customers,

cloud exit nodes

can make genuine users appear to come from different geographies.

Geo-blocking should therefore be thought of as a supporting control in particular situations, not as the main DDoS strategy.

### Can Rate Limiting Be Used at Layer 4?

Rate limiting is not used only at the HTTP level.

Network devices can also apply limits based on criteria such as;

connection rate,

SYN rate,

packet rate.

But the threshold values must be set correctly.

Too low a threshold can block genuine users.

Too high a threshold can allow the attack to be effective.

The normal traffic baseline must therefore always be known.

### Can DDoS Thresholds Be Set Without a Baseline?

Setting them soundly is difficult.

Suppose the firewall defines:

**SYN rate limit = 10,000/s**

as a policy.

What happens if the organisation sees 15,000 SYN/s during genuine campaign periods?

Legitimate users can be blocked.

Threshold values must therefore be set taking into account;

normal traffic,

peak traffic,

campaign periods,

expected growth.

### How Does a SOC Detect Layer 3 and Layer 4 DDoS?

The SOC can assess different telemetry sources together.

For example;

NetFlow,

sFlow,

firewall logs,

router telemetry,

anti-DDoS events,

NDR,

SIEM

data can be used.

Important signals may be;

a sudden bandwidth increase,

a PPS increase,

a distortion in the SYN/ACK ratio,

source IP diversity,

port-based anomalies,

a rise in connection failures.

### What Is NetFlow?

**NetFlow** is one of the technologies that allows summary data about network traffic flows to be collected.

Rather than retaining the full content of every packet, flow information such as;

source IP,

destination IP,

protocol,

port,

byte count,

packet count

can be provided.

It is extremely valuable for understanding traffic behaviour during DDoS analysis.

### How Does NDR See Layer 3/4 DDoS?

**Network detection and response (NDR)** can analyse anomalies in network behaviour.

Behaviour such as;

an abnormal packet rate,

an unexpected protocol distribution,

a large number of source IPs,

high connection failure rates

can be detected.

NDR can be particularly valuable for comparative behavioural analysis against a baseline.

### Why Is SIEM Correlation Necessary?

During a DDoS attack;

anti-DDoS can raise an alert.

Firewall CPU rises.

Application response time increases.

DNS queries change.

The ISP sends a notification.

Each of these events sits in a different system.

By correlating them, the SIEM can present the security team with a far more meaningful view of the attack.

A good DDoS detection model should therefore not consist of a single alert.

### How Is an L3/L4 DDoS Test Carried Out?

In corporate DDoS resilience testing, layer 3 and layer 4 scenarios can be applied in a controlled way.

Before the test;

the target IP,

the protocol,

packet size,

PPS,

CPS,

maximum bandwidth,

test duration,

stop conditions

must be determined.

The test can be increased gradually.

System resources are monitored at each stage.

The aim is not to crash the system without planning but **to measure the resilience limit in a controlled way**.

### What Should Be Measured in an L3/L4 DDoS Test?

In a professional test these metrics can be assessed:

#### Bandwidth

The Gbps level.

#### PPS

Packet processing load.

#### CPS

New connection capacity.

#### Concurrent Sessions

Total session usage.

#### Firewall CPU/Memory

Security device resource consumption.

#### Packet Loss

Network loss.

#### Latency

Delay.

#### Mitigation Time

How long anti-DDoS takes to engage.

#### Legitimate Traffic Availability

Whether genuine users could still be served.

These metrics show the attack's real impact.

### What Is the Biggest Mistake in L3/L4 DDoS Protection?

One of the most common mistakes is looking only at datasheet capacity.

For example:

#### Firewall throughput: 100 Gbps

does not on its own mean DDoS resilience.

In a real environment;

IPS,

NAT,

logging,

SSL inspection,

session tracking

may be active.

The same device can behave differently under 10 million PPS.

Real performance must therefore be verified under the organisation's own configuration.

### What Should an L3/L4 Protection Architecture Look Like?

It varies by organisation, but a layered architecture can be thought of as follows:

#### Internet

↓

#### ISP / Upstream Protection

↓

#### Anti-DDoS / Scrubbing

↓

#### Edge Router

↓

#### Firewall

↓

#### Load Balancer

↓

#### Application Infrastructure

The aim is to stop attack traffic as far out as possible.

Because if the attack has reached the firewall, upstream capacity may already be exhausted.

### The Relationship Between L3/L4 DDoS and Business Continuity

Layer 3 and layer 4 attacks look like a technical network problem.

But the consequence reflects directly on business continuity.

If an organisation's;

internet banking,

e-commerce site,

customer portal,

VPN service,

API

becomes unreachable at the network level, business processes can halt.

DDoS protection is therefore part not only of the network team's remit but of the organisation's **cyber resilience and business continuity** strategy.

### Conclusion: Gbps Alone Does Not Show DDoS Resilience

Layer 3 and layer 4 DDoS attacks can affect an organisation's internet availability before ever reaching the application layer.

A SYN flood;

can consume TCP connection state resources.

A UDP flood;

can generate high PPS and bandwidth.

A TCP connection flood;

can strain concurrent session limits.

An ACK flood;

can affect the packet processing capacity of stateful security devices.

Reflection and amplification;

can magnify the attacker's traffic impact.

It is therefore not enough for an organisation to ask:

**“How many Gbps of attack can we withstand?”**

The better questions are these:

#### How many PPS can we process?

#### How many CPS can we handle?

#### At what level does the firewall session table fill?

#### Where does the internet link reach saturation?

#### In how many seconds does anti-DDoS begin mitigation?

#### When scrubbing engages, does genuine user access continue?

#### How long does the SOC take to see the attack?

Real DDoS resilience is understood by measuring all of these together.

But a strong network layer does not mean the organisation is entirely safe.

Because the attacker can consume the application's own resources with entirely valid HTTP requests, without ever having to get past the firewall.

The traffic volume can be low.

The TCP connections can be entirely normal.

HTTPS can be valid.

And yet the login service, the API, the search function or the database backend can still become unusable.