What is a DDoS attack?

02The three types of DDoS attack

Attacks are usually classified by the layer they target, because that determines how they must be mitigated. Each type is also measured in a different unit, and bps vs pps vs rps explains why a flood that looks small in gigabits per second can still take down a server that survives a bigger one.

03Why amplification makes small attackers dangerous

Amplification lets an attacker turn a small amount of outbound bandwidth into a very large flood. The technique abuses UDP services that reply with far more data than they receive, such as misconfigured DNS resolvers, NTP servers or memcached instances.

The attacker sends a small request to such a server, but forges the source address so it appears to come from the victim. The server dutifully sends its large reply to the victim. With an amplification factor of fifty, a single gigabit of attacker bandwidth becomes fifty gigabits arriving at the target — from servers that are themselves innocent. CISA's amplification table puts DNS at 28 to 54 times, NTP at about 557 and memcached at 10,000 to 51,000; amplification attacks explained works through the arithmetic.

Forging the source address only works where networks do not apply the ingress filtering described in BCP 38 (RFC 2827), which has asked providers since 2000 to drop packets whose source addresses do not belong to their customers.

04Layer 7 attacks: small, cheap and hard to see

Application-layer attacks such as an HTTP flood do not need volume. A request that triggers a full-text search across a large table, or a login attempt that runs a deliberately slow password hash, costs the attacker almost nothing and costs the server a great deal. A few thousand of those per second can take down infrastructure that would shrug off a far larger flood of junk packets.

They are also much harder to identify, because each individual request looks legitimate. The traffic is well-formed HTTPS, often with plausible browser headers, sometimes even from residential addresses. The difference from real traffic is not in any single request but in the pattern across many of them, which is why defences judge behaviour over time rather than inspecting requests one by one.

Slow attacks are a quieter variant. Slowloris holds connections open with deliberately incomplete requests, so a server runs out of connection slots while its bandwidth graph stays flat.

05How big and how frequent attacks are

Attack volumes grow every year, so any figure dates quickly. The most recent public reports give a sense of scale:

• Cloudflare reported 47.1 million DDoS attacks in 2025, an average of 5,376 every hour; network-layer attacks made up 78% of the fourth-quarter total
• The largest in that report peaked at 31.4 Tbps and lasted 35 seconds
• Botnets have grown with cheap connected devices: Mirai, which appeared in 2016, peaked at about 600,000 infected devices, while Cloudflare estimates the Aisuru-Kimwolf botnet at 1 to 4 million infected hosts, mostly Android TV devices
• In the first half of 2026, 90.60% of the network-layer attacks Cloudflare mitigated ended within ten minutes, and DNS-based attacks accounted for 34.3% of network-layer activity

06How to tell you are under attack

The first symptom is nearly always a slow or unreachable service, and the useful question is which resource ran out, because that tells you the layer: a full uplink points to a volumetric flood, timed-out connections with normal bandwidth to a protocol flood, a saturated CPU or database to an application attack, and a healthy server whose name will not resolve from outside your network to an attack on your DNS provider. Signs of a DDoS attack pairs each symptom with a test that confirms it and the ordinary causes that look the same, such as a genuine traffic spike or a failing origin. If it is an attack you cannot absorb, emergency onboarding gets protection in front of the service quickly.

07What mitigation actually looks like

Different layers need different answers, and running only one leaves an obvious gap.

• Volumetric floods must be absorbed upstream — on a network with more capacity than the attack, before your own uplink saturates
• Protocol attacks are handled in the kernel at the edge, using connection limits and SYN cookies rather than application logic
• Application attacks require inspecting requests and separating automation from people, usually with challenges rather than outright blocks
• Caching removes a surprising share of attack traffic, because requests served from the edge never reach the origin at all