How long do DDoS attacks last?

02What the published data shows

The figures below are taken directly from dated vendor and research reports. They measure different networks and windows, so they are not identical, but they point the same way: the median attack is brief.

03The biggest attacks are the shortest

Counterintuitively, the record-breaking volumetric attacks tend to be the briefest. Cloudflare reported that a 31.4 Tbps attack in its Q4 2025 report "lasted just 35 seconds", and that a 7.3 Tbps attack in May 2025 delivered 37.4 terabytes in 45 seconds. These are concentrated bursts: the attacker pours everything into a few seconds to overwhelm defences before they can engage. What a headline figure in terabits per second does and does not tell you is explained in bps vs pps vs rps.

The pattern has a name — hit-and-run. Instead of one sustained flood, the attacker fires repeated short bursts, sometimes over hours, letting the target recover just enough between waves to waste effort on each restart. NETSCOUT's data shows the very shortest attacks gaining share over time, consistent with automation making these bursts cheap to launch.

Read the duration numbers with one caveat: each vendor measures its own network and defines an 'attack' slightly differently, so a figure like 90% under ten minutes describes that provider's observed traffic, not a universal law. The agreement across independent reports — Cloudflare, Microsoft and NETSCOUT all pointing the same way — is what makes the short-burst conclusion reliable, even though the exact percentages differ: NETSCOUT, for example, places most attacks in the 5–15 minute band rather than under five minutes.

04When attacks run for hours or days

Long attacks are the exception, and they usually signal intent. Kaspersky's Securelist reported that the longest DDoS attack its botnet-monitoring system recorded in Q3 2022 lasted 451 hours — more than eighteen days — with an average that quarter of about two hours. Akamai described mitigating roughly 419 terabytes of traffic against a financial-services target over almost a full day in July 2024, part of a dedicated campaign rather than a drive-by.

Sustained campaigns like these tend to accompany extortion, hacktivism tied to a news event, or a grudge against a specific target. They are rarer than the short bursts but far more damaging if a service has no standing protection, because the pressure does not let up.

05Why attackers favour short bursts

Short attacks are cheaper and harder to defend against. They use fewer botnet resources — booter services sell attacks by the minute — they are over before a traffic graph is even checked, and they exploit the single weakness of on-demand defences: the time it takes a human to notice, decide, and switch mitigation on.

Cloudflare put the problem plainly: when an attack lasts half a minute to ten minutes, "there is no practical window for human intervention: by the time an alert reaches a security analyst, the attack has already completed". Microsoft's 2022 review says short attacks "take advantage of the time it takes systems to detect the attack", and its Azure team describes bursts "designed to outrun manual response". If your defence depends on someone reacting, the attacker has already won by the time you react.

06Why always-on beats on-demand

The duration data is the strongest argument for always-on protection. On-demand or "scrubbing-on-request" models assume there is time to detect an attack and redirect traffic — typically minutes. Against an attack that lasts seconds, that window does not exist; the attack is finished before redirection completes, and it simply repeats.

Always-on protection keeps traffic flowing through a filtering network continuously, so mitigation is already in place when a burst arrives. For the short, automated attacks that make up the overwhelming majority of incidents, it is the only model that engages in time. The practical steps are covered in how to stop a DDoS attack, and the always-on approach in DDoS mitigation and DDoS-protected hosting.

The duration data turns into a short set of questions you can put to your own setup or to any provider:

• Is filtering running all the time, or does a person or a trigger have to switch it on? If the latter, how long does activation take?
• Does your monitoring record bursts shorter than its sampling interval, or do they vanish into averaged graphs? The signs of a DDoS attack show what to look for.
• Are repeated waves handled automatically each time, or does every wave restart a manual process?
• Is the origin's address private, so the attacker cannot simply bypass the filtering network? See how to hide your origin IP.
• After a past incident, how long did recovery take compared with the attack itself?