DoS vs DDoS as Availability Failures

Confidentiality and integrity get most of the beginner drama. Availability is the third letter: the shop must stay open. If a service cannot answer, customers, patients, or classmates are locked out even when no secret leaked. Exhausting a resource until that happens is the harm this module names. On a system you own, you may talk about capacity, timeouts, and rate limits. On a system you do not own, sending traffic designed to knock it over is unauthorized interference with a computer — in many places a crime — even if you call it practice, even if the packet is “only SYN,” even if the target is a café landing page. Skill does not create consent. A public website is still someone else’s computer.

Write the legal sentence before you write any command: original Cyberlium teaching mapped to the CEH v13 denial-of-service domain — not official EC-Council training, not a cert, not exam dumps. A cert acronym in a blog title is not a warrant. LOIC, HOIC, “stresser” rentals, and copy-paste flood one-liners are out of this course. If you cannot say in one sentence why the host is in scope, it is not in scope. For this whole module the only hands-on host is loopback on a machine you control, and that lab is Lesson 4: a limiter YOU wrote, not a weapon you pointed outward.

cat >> "$NOTES" << 'EOF'
availability: the A in CIA
dos_means: exhaustion so legitimate users cannot use the service
refuse: floods, hping, cafe stress tests, LOIC
EOF

Volume exhaustion is the blunt picture: more bits than the pipe or the edge can forward, so legitimate packets wait or drop. You need the name so you can later talk about capacity, anycast, and upstream help. You do not need a packet-per-second cookbook. Protocol exhaustion is the state picture: handshake tables, half-open connection slots, or other finite protocol memory filling until new honest clients cannot complete. SYN is a named TCP flag from Topic 3 — naming “handshake-table exhaustion” is literacy. Sending crafted handshake floods at anyone is not this lesson and is not Lesson 4. Application exhaustion is the work picture: a few expensive requests (heavy search, password hashing on login, a report export) tying up workers so cheap honest traffic queues. Defenders rate-limit and cache those paths. Attack blogs that teach you how to aim the expensive request at a stranger are not this course.

Keep a useful failure in mind: a classmate says “just a small flood, we will stop in ten seconds.” Ten seconds of unauthorized traffic is still unauthorized. Amplification (historically: open resolvers reflecting more bytes than they received) is a named concept so you understand why operators close open services — not a lab in spoofing. Slow connection-holding at the application layer is a named idea so you understand why timeouts and connection caps exist — not a script you point at school.edu. If a sentence would help someone knock over a host they do not own, it does not belong in your notes.

DoS, as this course uses the letters, is exhaustion driven from one vantage (one host, one process, one network you could name). DDoS is the same class of harm with many vantages at once — often devices someone else already compromised, which Lesson 2 will treat as a defender problem, not a recruitment guide. From the victim’s chair the outage looks similar: the site is slow or gone. From the defender’s chair the response differs: one noisy source may be filtered; many sources need rate limits, anycast, and upstream help (Lesson 3). Neither word is a permission slip. “It was only DoS, not DDoS” is not a defense. “It was distributed so I did not press the button myself” is not a defense if you aimed the traffic.

You may read public after-action reports that name volumetric events, protocol events, or application events. Reading a public postmortem is literacy, like reading an NVD page in Module 5. Replaying the event against a shop, a café, or a classmate is not literacy. If you do not own a production site, you still complete this lesson on definitions. Do not “borrow” a friend’s hostname to make the words feel real. Easy is the point: you are learning the ethics of availability, not filling a binder with other people’s outages you caused.

A DoS literacy note is boring on purpose. Date (UTC). Definitions of DoS and DDoS in your own words. Three buckets: volume, protocol, application — each in one sentence, no commands. Ethics line: no LOIC, no hping flood, no café, no classmate site, no “small SYN.” Legal line: original Cyberlium teaching mapped to the CEH v13 denial-of-service domain — not official EC-Council training, not a cert, not exam dumps. Notes path: $HOME/cyberlium-lab/dos-vs-ddos-notes.txt, chmod 600. Empty files fail. Files that list target IPs you do not own fail even if you “only planned.” World-readable 777 fails.

A useful feeling: the lesson is “too small” because you did not generate traffic. That feeling is how people graduate into unauthorized floods. The skill is stopping at names. Lesson 4 will let you see HTTP 429 on a listener YOU started on 127.0.0.1 — a limiter, not a cannon. Until then, a filled definition file is a complete Lesson 1. Do not add a second host because loopback felt later. Do not paste stresser URLs into the notes as “research.”

On a computer you own, create cyberlium-lab if needed. Fill the template in your own words. Do not add a traffic generator. Do not add a target that is not a definition. chmod 600. The block below writes the file and refuses to become a flood kit — there is no packet loop, no extra host, no LOIC.

cat >> "$NOTES" << 'EOF'
dos: one source exhausting A
ddos: many sources — same harm, harder to ignore one IP
ethics: I do not flood anyone
EOF

You now treat denial of service as a named harm to availability — volume, protocol, or application exhaustion — and you treat LOIC, hping floods, café drills, and classmate stress tests as out of this course. DoS is one source; DDoS is many; the harm is the same outage. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 denial-of-service domain — not official EC-Council training, not a cert, not exam dumps. Next — Why Botnets Exist (Defender View) — compromised IoT and the need for updates, still not a botnet you build.