What is a distributed denial of service attack?

 Elizabeth Weise , USATODAY

The internet's address book sends you to the sites you want — and when it breaks, it can break everything else. Video provided by Newsy Newslook

(Photo: Wavebreakmedia Ltd, Getty Images)

A large-scale distributed denial of service attack (DDoS) against New Hampshire-based Internet performance company Dyn caused major Internet disruptions Friday. Users were unable to access many major websites such as Twitter, Spotify, Netflix, Amazon, Tumblr, Reddit and other sites.

Here's how a DDoS attack works:

As part of its business, Dyn provides DNS services for a given swath of the Internet, effectively its address book. DNS stands for Domain Name System, the decentralized network of files that list the domain names human beings use, such as usatoday.com, with their numeric Internet Protocol addresses, such as 184.50.238.11, which is how computers look for websites. These are computers that contain databases of URLs and the Internet Protocol addresses they represent.

"If you go to a site, say yahoo.com, your browser needs to know what the underlying Internet address that’s associated with that URL is. DNS is the service that does that conversion,”  said Steve Grobman, chief technology officer for Intel Security.

For example, the IP address for yahoo.com is 209.191.88.254.

The attack hit the Dyn server that contains that address book. Dyn provides that service to multiple Internet companies. For anyone linked to a computer that used the service, when they entered twitter.com or tumblr.com or Spotify.com, via a complex series of jumps the address book is able to tell their browser which numerical IP address to look at.

The DDoS attack floods that server with illegitimate requests, so many that very few real requests can get through. The user gets a message that the server is not available. Service is intermittent because a few requests are sometimes still able to go through.

In addition, many sites keep cached address books their computers can refer to. However those caches always have a time limit on them and when that “time to live” expires, they must go back to the DNS server to confirm the IP address is valid. If the DNS server is unavailable, a site that was working could suddenly stop being available, said Grobman.