I mean let's suppose that there is a large DDoS attack to a virtual machine which is running on a physical server with other 10 virtual machines, how the other virtual machines will be effected from this attack?

  • This entirely depends on the physical design of the host machine. If there is a single network adapter then obviously every VM on the machine will be effected. – Ramhound Jan 15 '16 at 22:26

A virtual machine shares the physical network card with the other virtual machines on the physical machine. So if a DDoS attack is powerful enough the overwhelm the capacity of the network card it would indeed deny access to the other virtual machines.

However this assumes that there is no quality of service software in place, which might only allow the virtual machine to take up a percentage of the bandwidth. An DDoS attack is this situation may not directly affect the physical machine but could overwhelm the router, creating the same effect.


DDOS attack is a very broad term. There are many different forms of DDOS attacks.

  • TCP Connection Attacks - Occupying connections
  • Volumetric Attacks - Using up bandwidth
  • Fragmentation Attacks - Pieces of packets
  • Application Attacks - Targeting applications

Amplification: Two ways attacks can multiply traffic they can send.

  • DNS Reflection - Small request, big reply.

    By forging a victim's IP address, an attacker can send small requests to a DNS server and ask it to send the victim a large reply. This allows the attacker to have every request from its botnet amplified as much as 70x in size, making it much easier to overwhelm the target.

  • Chargen Reflection - Steady streams of text

    Most computers and internet connected printers support an outdated testing service called Chargen, which allows someone to ask a device to reply with a stream of random characters. Chargen can be used as a means for amplifying attacks similar to DNS attacks

Attack types :

Smurf Attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address.

Teardrop attack involves sending mangled IP fragments with overlapping, over-sized payloads to the target machine. This can crash various operating systems because of a bug in their TCP/IP fragmentation re-assembly code.

Ping of death is a type of attack on a computer system that involves sending a malformed or otherwise malicious ping to a computer.

Peer-to-Peer there is no botnet and the attacker does not have to communicate with the clients it subverts. Instead, the attacker acts as a "puppet master," instructing clients of large peer-to-peer file sharing hubs to disconnect from their peer-to-peer network and to connect to the victim's website instead

Permanent denial-of-service (PDoS) or Phlashing is an attack that damages a system so badly that it requires replacement or reinstallation of hardware. Unlike the distributed denial-of-service attack, a PDoS attack exploits security flaws which allow remote administration on the management interfaces of the victim's hardware, such as routers, printers, or other networking hardware. The attacker uses these vulnerabilities to replace a device's firmware with a modified, corrupt, or defective firmware image—a process which when done legitimately is known as flashing. This therefore "bricks" the device, rendering it unusable for its original purpose until it can be repaired or replaced.

many more ...

So it depends what type of attack is used... if the attack manages to 'cripple' the host machine somehow ( misconfiguration allowing too much resources to be used by a virtual machine, eating bandwidth, Level 2 attack of some kind making a firewall or IDS to reject all traffic ... etc... ) then all virtual machines will suffer. Properly configured host will lessen the effect of (D)DOS attack on some of it's virtual machines, load-balancing the cpu / ram / net usage and such between the virtual machines. Anyway there are a number of mitigation techniques that can be set up against (D)DOS attacks ranging from simply blocking known botnets to full fledged commercial solutions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.