What Is a DDoS Attack? Distributed Denial of Service Explained

DDoS attacks flood servers with traffic to make them unavailable. Learn the difference between DoS and DDoS, the main attack types, how botnets work, and how organisations defend against them.

What Is a DoS Attack?

A Denial of Service (DoS) attack attempts to make a system, service, or network unavailable to legitimate users by overwhelming it with traffic or requests. The attacker's goal is not to steal data but to cause downtime — disrupting operations, damaging reputation, or extorting victims.

A Distributed Denial of Service (DDoS) attack does this using thousands or millions of sources simultaneously, making it much harder to block.

DoS:
[Single Attacker] ──── huge traffic ────> [Target Server] 💥

DDoS:
[Attacker controls botnet]
    ├── [Compromised PC]  ─┐
    ├── [IoT Camera]      ─┼──── coordinated flood ──> [Target Server] 💥
    ├── [Home Router]     ─┤
    └── [Cloud server]    ─┘

How DDoS Attacks Work: Botnets

Most large DDoS attacks use botnets — networks of devices infected with malware that respond to commands from a Command and Control (C2) server. The device owners are typically unaware their devices are being used.

Mirai (2016) was a landmark DDoS botnet: it infected hundreds of thousands of IoT devices (routers, IP cameras, DVRs) using default credentials. At its peak, it generated 1.2 Tbps of traffic — the largest DDoS recorded at the time. It took down DNS provider Dyn, causing outages for Twitter, GitHub, Netflix, and others.

Modern botnets are sold or rented as DDoS-for-hire services (stresser/booter services), allowing anyone with cryptocurrency to launch large attacks.

Categories of DDoS Attacks

1. Volumetric Attacks (Layer 3/4)

Flood the target's network bandwidth with sheer volume of traffic.

UDP-the-internets-core-protocol) Flood: Sends massive numbers of UDP packets to random ports. The target must process each packet-ip-the-internets-core-protocol) and send ICMP-and-network-diagnostics-explained) "port unreachable" responses, consuming resources.

[ICMP-and-network-diagnostics-explained) flood](/learning-center/what-is-icmp-ping-and-network-diagnostics-explained) (Ping Flood): Sends continuous ICMP Echo Requests. The target's CPU and network are overwhelmed responding.

Amplification Attacks: exploit protocols that respond with more data than the request:

| protocol | Amplification Factor | |---|---| | DNS | Up to 70x | | NTP | Up to 556x | | Memcached | Up to 51,000x |

In a DNS amplification attack: attacker sends small DNS queries with the victim's spoofed IP as source. DNS servers send large responses to the victim — the attacker amplifies traffic by 70x without needing a large botnet.

2. Protocol Attacks (Layer 3/4)

exploit weaknesses in network [protocol](/learning-center/what-is-the-osi-model-all-7-layers-explained) implementations.

SYN-the-internets-core-protocol) Flood: The attacker sends thousands of TCP SYN packets with spoofed source IPS. The target allocates resources for each half-open connection and sends SYN-ACK responses that never receive an ACK. The connection table fills up, preventing legitimate connections.

[ping of death](/learning-center/what-is-ICMP-ping-and-network-diagnostics-explained): (Historical) Sending malformed oversized ICMP packets that crash systems. Patched in modern operating systems.

3. Application Layer Attacks (Layer 7)

Target web application or API functionality rather than raw bandwidth.

HTTP Flood: Legitimate-looking HTTP GET or POST requests sent at high volume. Servers must process each request fully — parsing, database queries, rendering. Even a few hundred requests per second can overwhelm unprotected applications.

Slowloris: Opens many HTTP connections and sends headers slowly, keeping connections open indefinitely. Ties up web server connection slots without sending much traffic.

ReDoS (Regular Expression DoS): Sends input crafted to trigger catastrophic backtracking in poorly written regular expressions, consuming 100% CPU.

Measuring DDoS Attacks

  • Gbps / Tbps: Bandwidth consumed (volumetric attacks). Attacks exceeding 3 Tbps have been recorded.
  • Mpps: Millions of packets per second (protocol attacks). High packet-the-internets-core-protocol)-ip-the-internets-core-protocol) rates can overwhelm even large infrastructure.
  • RPS: Requests per second (application attacks). Sophisticated attacks may need only thousands of RPS to overwhelm an unprotected application.

DDoS Mitigation Strategies

1. Over-Provisioning Bandwidth

Having more bandwidth than attackers can throw is expensive but effective for small attacks. Not viable against Tbps attacks.

2. Rate Limiting

Limit the number of requests from a single IP within a time window. Effective for simple floods but bypassed by distributed botnets using thousands of IPS.

3. CDN and Anycast Scrubbing

Content Delivery Networks (CDN) like Cloudflare, AWS Shield, and Akamai absorb attacks across globally distributed infrastructure using Anycast [Routing](/learning-center/what-is-the-network-layer-osi-model-layer-3) — traffic is routed to the nearest scrubbing centre, which filters malicious packets.

Cloudflare, for example, has network capacity exceeding 100 Tbps and handles many of the largest DDoS attacks seen.

4. SYN Cookies

A technique where the server does not allocate connection resources until the three-way handshake-the-internets-core-protocol)-ip-the-internets-core-protocol) completes. Prevents SYN flood attacks from exhausting connection tables.

5. IP Reputation and Blocklists

Block known bad IPS, Tor exit nodes, and traffic from countries not served by the application. Effective but risks blocking legitimate users.

6. CAPTCHA and Bot Challenges

Layer 7 attacks are harder to filter because traffic looks legitimate. Presenting JavaScript or CAPTCHA challenges distinguishes bots from browsers.

7. Web Application Firewall (WAF)

Inspects HTTP traffic and blocks patterns matching known attack signatures or anomalous behaviour.

DDoS vs Dos vs Ransomware

| | DoS | DDoS | ransomware-types-and-prevention) | |---|---|---|---| | Goal | Availability disruption | Availability disruption at scale | Extortion | | Sources | Single attacker | Thousands of sources (botnet) | Single attacker (persistence) | | Data stolen | No | No | Sometimes | | Detection | Easier | Harder | Different indicators |

Protecting Your Infrastructure

  • Use a CDN with built-in DDoS protection for web services
  • Enable SYN-the-internets-core-protocol) cookies on your web servers and firewalls
  • Implement rate limiting and request throttling at the application layer
  • Use Anycast scrubbing services for critical infrastructure
  • Have an incident response-security-operations-centre-SIEM-incident-response-explained) plan for DDoS events — contact your ISP and mitigation provider

Summary

  • DoS uses a single source; DDoS uses thousands via botnets to overwhelm targets
  • Volumetric attacks flood bandwidth; protocol attacks exhaust state; application attacks target logic
  • Amplification attacks use legitimate servers to amplify traffic by 70x–51,000x
  • CDNs, Anycast scrubbing, rate limiting, SYN-the-internets-core-protocol) cookies, and WAFs are the core defences
  • DDoS-for-hire services make attacks accessible to non-technical actors