Types of DDoS attacks: volumetric, protocol and application layer

02Volumetric attacks

Volumetric attacks win by brute force: send more traffic than the target's link can carry, and everything behind it is unreachable regardless of how healthy the server is. They are the most familiar family and the easiest to understand.

Many large volumetric floods are amplified reflection, because that is how an attacker turns a modest upstream into hundreds of gigabits. They are defeated only by capacity — a network upstream of you with far more headroom than the attack, which absorbs the flood before it reaches your uplink.

• UDP flood — connectionless packets fired at line rate, the staple against game and voice servers
• Ping / ICMP flood — echo requests at volume, consuming bandwidth in both directions
• DNS amplification and the wider family of reflection and amplification attacks — NTP, memcached, SSDP, CLDAP
• Smurf attack — the historic ICMP-broadcast ancestor of modern reflection

03Protocol and state-exhaustion attacks

Protocol attacks target Layers 3 and 4, exhausting the finite state that network devices keep per connection rather than raw bandwidth. They are measured in packets per second, and their tell is that the traffic graph can look calm while a firewall, load balancer or server is already refusing connections.

They are stopped at the edge: SYN cookies that avoid allocating state until a handshake completes, connection tracking that drops packets matching no real flow, and kernel-level filtering with the packet-rate headroom to classify every packet cheaply. A stateful firewall without that headroom becomes the victim itself.

• SYN flood — half-open handshakes that fill the connection backlog
• ACK, SYN-ACK and PSH-ACK floods — orphaned packets that force connection-table lookups
• Ping of death and fragmentation attacks — malformed packets against reassembly code
• Connection-exhaustion variants that open and abandon TCP connections to occupy slots

04Application-layer attacks

Application-layer attacks operate at Layer 7, where every request is individually well-formed and looks like a real visitor. Instead of volume they aim at the most expensive thing the application does — a search query, a login, a dynamic page that hits the database — and repeat it until the back end buckles. The request rate can look unremarkable while the application is on its knees.

They are the hardest family to filter, because telling an attacking request from a genuine one cannot be done by packet shape alone; it needs request inspection, behavioural signals and sometimes a challenge. This is the domain of a web application firewall, covered in depth under what is a WAF and what is an HTTP flood.

05Multi-vector and carpet-bombing attacks

Real campaigns rarely stay in one box. A multi-vector attack combines families deliberately — say a volumetric UDP flood to saturate the link, a SYN flood to exhaust state, and an HTTP flood to drain the application — so a defender who closes one door is still losing through the others. The roughly 840-million-packet-per-second attack OVHcloud mitigated in April 2024, for example, paired a TCP ACK flood (99% of packets) with DNS reflection. That mix is why single-layer protection fails in practice.

Carpet-bombing (also called spread-spectrum or subnet attack) is an evasion tactic first seen around 2016. Instead of hammering one address, the attacker spreads traffic nearly uniformly across an entire prefix — a /24 or larger — so each individual address sees only a trickle, below any per-IP alarm, while the prefix as a whole is saturated. Per-IP threshold detection misses it entirely; it has to be caught by watching aggregate traffic at the network boundary. Because these floods are often fragmented, rate-limiting non-initial fragments to a low value is a common and usually safe mitigation.

06Choosing the right defence

The taxonomy exists to be acted on. Identify which family (or families) you face from the signature, using the checks in signs of a DDoS attack, then apply the matching defence — capacity for volume, edge filtering for protocol attacks, request inspection for Layer 7 — and expect to need more than one at once.

For web properties, a reverse proxy handles the application and protocol layers and absorbs volumetric floods aimed at the HTTP service; that is the job of a WAF and CDN backed by DDoS protection. For raw IP services — game servers, voice, anything non-HTTP — the same protection is delivered through routed transit rather than a proxy; GRE transit is the Layer 3/4 route (coming soon, talk to us). Whichever you need, the honest rule holds: no single layer is enough on its own, and the attacker chooses the mix.