hpnicfDDosAttackType identifies the specific category of DDoS attack detected against a protected IP address, using named values such as synflood, smurf, teardrop, or pingofdeath. Carried in the DDoS start trap, it tells the admin exactly what kind of abnormal traffic pattern the Abnormal Flow Clean system flagged so they can respond appropriately. For example, a trap reporting hpnicfDDosAttackType as synflood(5) tells the admin the device is under a SYN flood attack rather than, say, an ICMP flood.