{"id":3649,"date":"2018-08-09T16:27:12","date_gmt":"2018-08-09T16:27:12","guid":{"rendered":"https:\/\/hostnoc-revamp.branex.org\/blog\/?p=3649"},"modified":"2025-08-15T12:01:55","modified_gmt":"2025-08-15T12:01:55","slug":"ddos-vulnerabilities-on-separate-layers-of-the-osi-model-how-to-mitigate-them","status":"publish","type":"post","link":"https:\/\/hostnoc-revamp.branex.org\/blog\/ddos-vulnerabilities-on-separate-layers-of-the-osi-model-how-to-mitigate-them\/","title":{"rendered":"DDoS Vulnerabilities on Separate Layers of the OSI Model &#038; How to Mitigate Them"},"content":{"rendered":"<p><span style=\"font-weight: 400;\">If you have previously worked in the telecommunication field, most vendors you come across make an attempt to explain products and services in terms of the OSI Model. For someone who has some background in the field of networking and communications can understand what the OSI Model is, but in case you don\u2019t belong to the field, you need to develop a bit of an understanding. Although OSI models are important for carrying out discussions and conducting evaluative sessions, it is still not implemented in actual in most cases. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">So, why particularly is it important to learn what the OSI Model is all about? When we talk about DDoS Attacks they usually target the very layers in the OSI model. Understanding the layers will eventually help users understand where the vulnerabilities lie and how can one keep the infrastructure protected. To give you a brief overview, the OSI model was originally developed by representatives of some of the major telecommunication companies in the year 1983. It was established as a common reference model which standardized the governance of transmission of data packets and was adopted as a standard by the ISO. <\/span><\/p>\n<h2>Explaining the OSI Model Layers<\/h2>\n<p><span style=\"font-weight: 400;\">The process of communication in networking is dependent on two endpoints. It can be divided into seven different layers based on their relative functions. In the OSI model architecture, each layer is dependent on the layer above it and is equally dependent on the layer below it. If the lower layer doesn\u2019t fulfill the function, the consecutive layer will fail to get executed stopping the whole process in its wake. The data flows up from the source computer across the network and then ultimately flows down through the layers within the receiving computer. \u00a0<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Here is a graphical representation of the OSI Model specifying layers<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Sending signals over a network using an Ethernet cable or fiber optic cable or WiFi requires a combination of application, operating systems, network card drivers and network hardware. These signals are delivered through seven layers of the function of the OSI Model. <\/span><\/p>\n<p><span style=\"font-weight: 400;\">Let\u2019s discuss these seven layers in a top to bottom approach.<\/span><\/p>\n<h2><b>Layer 7: Application Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Layer 7 commonly known as the Application Layer is the layer where communication partners are identified. This is the database access level where end-user protocols such as FTP, Telnet, SMTP and RAS perform their respective functionalities. All messages and packet creations begin at this level. Here, the data is expressed visually so the user can understand. Although the layer is not the application itself, it contains a set of services an application can use. <\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<ul>\n<li>PDF GET requests, HTTP GET, HTTP POST, = website forms (login, uploading photo\/video, submitting feedback)<\/li>\n<\/ul>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">One way to counteract the <a href=\"https:\/\/hostnoc-revamp.branex.org\/blog\/ddos-protection\/\">DDoS attack possibility<\/a> on Layer 7 is to bring monitoring software applications into practice. By using a set of dedicated algorithms and technologies which can detect zero-day attacks, effective application monitoring can stop and track back the source from where the attack initiated.<\/span><\/p>\n<h2><b>Layer 6: The Presentation Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Known as the Translator, the presentation layer or the Layer 6 is that part of the operating system (OS) which translates the data from the source format into a common format and then send it to the receiver and vice versa. It uses the protocol of compression and encryption during the transaction of information between users. \u00a0<\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Malformed SSL Requests, Inspecting SSL encryption packets is resource intensive. <\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Attackers use SSL to tunnel HTTP attacks to <a href=\"https:\/\/hostnoc-revamp.branex.org\/blog\/dedicated-servers\/\">target the server<\/a>.<\/span><\/li>\n<\/ol>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">One way to avoid this attack is to offload the SSL from the origin infrastructure. Once, you have successfully done that, it\u2019s time to inspect the application traffic for any signs of malicious activities. Be sure to check up on any violations of policy at an application delivery platform (ADP). An effective ADP will also make sure that the traffic is re-encrypted and sent back to the origin infrastructure. <\/span><\/p>\n<h2><b>Layer 5: The Session Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">This layer is responsible for establishment, coordination, and termination of sessions. In case, if there is any interruption in between the session process, this service reviews the authentication<\/span><\/p>\n<p><span style=\"font-weight: 400;\">and reconnect the layers together. Commonly, Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) make the better use of this service when working with applications. <\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Telnet DDoS-attacker exploits a flaw in a Telnet server software running on the switch, rendering Telnet services unavailable.<\/span><\/p>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The only way to resolve this vulnerability is to keep your hardware up to date. Most commonly, the hardware provider issues a version update or a patch which enable users to mitigate the vulnerability.<\/span><\/p>\n<h2><b>Layer 4: The Transport Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The transport layer, on the other hand, is responsible for the packetization of data. It delivers packets of information error-free without observing any losses or duplication. For most applications running on the Internet, these services are provided by the TCP and UDP. <\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">SYN Flood, Smurf Attack<\/span><\/p>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">A typical method to stop from DDoS attacks taking place on this level is through blackholing. It is a method implied by the ISPs to stop any DDoS attack that a customer experience at the transport layer. However, this approach to keep the DDoS attack out of the system stops all traffic (malicious and legitimate) from getting into the system. \u00a0<\/span><\/p>\n<h2><b>Layer 3: The Network Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The particular layer that handles the routing of data is termed as the network layer. It is also responsible for switching information from one network to another. It specifies the right destination for all transmission data at the packet level. IP is the most common example of a network layer operating on the Internet. \u00a0<\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">ICMP Flooding &#8211; A Layer 3 infrastructure DDoS attack method that uses ICMP messages to overload the targeted network&#8217;s bandwidth.<\/span><\/p>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">You can prevent this kind of attack from taking place by rate-limiting ICMP traffic.<\/span><\/p>\n<h2><b>Layer 2: Data Link Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The Data-Link Layer is a protocol layer which transfers data frame in between nodes of the physical layer. It is responsible to conduct an error-free transfer which allows the layer above it to assume they are virtually error-free. The layer comprises two sub-layers namely; <\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The logical link control layer<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">The media access control layer (MAC) <\/span><\/li>\n<\/ol>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">MAC flooding is an attack that inundates the network switch with data packets which usually takes place at the Data Link Layer.<\/span><\/p>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Advance switches can be configured to limit the number of MAC addresses which are more likely to be learned on ports connected to end stations.<\/span><\/p>\n<h2><b>Layer 1: The Physical Layer<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">The physical layer is the bottom layer of the OSI model. It is concerned with the transmission and reception of the unstructured raw bit stream over a physical medium. The physical layer covers a variety of devices and mediums, among them cabling, connectors, receivers, transceivers, and repeaters.<\/span><\/p>\n<h2><b>Vulnerabilities to DDoS Attack<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Physical destruction, obstruction, manipulation, or malfunction of physical assets<\/span><\/p>\n<h2><b>Mitigation<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Practice defense-in-depth tactics, use access controls, accountability, and auditing to track and control physical assets<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you have previously worked in the telecommunication field, most vendors you come across make an attempt to explain products and services in terms of the<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":2,"featured_media":13394,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[31],"tags":[],"class_list":["post-3649","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity"],"acf":[],"_links":{"self":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/3649","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/comments?post=3649"}],"version-history":[{"count":1,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/3649\/revisions"}],"predecessor-version":[{"id":12355,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/3649\/revisions\/12355"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/media\/13394"}],"wp:attachment":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/media?parent=3649"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/categories?post=3649"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/tags?post=3649"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}