Quick answer
A DDoS (distributed denial-of-service) attack is an attempt to make a service unavailable by overwhelming it with traffic from many different machines at the same time. The word distributed is the important part: because the traffic arrives from thousands of separate addresses, often ordinary devices compromised without their owners' knowledge, it cannot be stopped by blocking a single source. Attacks are grouped by which layer they exhaust — the network link, the connection table, or the application itself.
How a DDoS attack works
An attacker controls a large number of machines — a botnet — assembled from compromised servers, routers, IoT devices and rented cloud instances. On command, every machine sends traffic to the same target at once.
The goal is exhaustion of a finite resource. That might be bandwidth on the uplink, entries in a connection table, worker processes in a web server, or database connections behind it. Whichever runs out first is the bottleneck, and once it is gone, legitimate requests queue behind attack traffic and time out.
Crucially, an attacker does not need to break anything. There is no vulnerability being exploited in a pure DDoS — the service is doing exactly what it was built to do, just far more often than it was built for.
The three types of DDoS attack
Attacks are usually classified by the layer they target, because that determines how they must be mitigated.
| Type | Layer | Method | Measured in |
|---|---|---|---|
| Volumetric | 3 – 4 | Raw traffic flood, often amplified through open UDP services | Gbps / Tbps |
| Protocol | 3 – 4 | Exhausting connection state, e.g. SYN floods leaving half-open connections | Packets per second |
| Application | 7 | Expensive HTTP requests — search queries, logins, cart operations | Requests per second |
Why amplification makes small attackers dangerous
Amplification lets an attacker turn a small amount of outbound bandwidth into a very large flood. The technique abuses UDP services that reply with far more data than they receive, such as misconfigured DNS resolvers, NTP servers or memcached instances.
The attacker sends a small request to such a server, but forges the source address so it appears to come from the victim. The server dutifully sends its large reply to the victim. With an amplification factor of fifty, a single gigabit of attacker bandwidth becomes fifty gigabits arriving at the target — from servers that are themselves innocent.
Layer 7 attacks: small, cheap and hard to see
Application-layer attacks do not need volume. A request that triggers a full-text search across a large table, or a login attempt that runs a deliberately slow password hash, costs the attacker almost nothing and costs the server a great deal. A few thousand of those per second can take down infrastructure that would shrug off a hundred gigabits of junk packets.
They are also much harder to identify, because each individual request looks legitimate. The traffic is well-formed HTTPS, often with plausible browser headers, sometimes even from residential addresses. The difference from real traffic is not in any single request but in the pattern across many of them.
This is where fingerprinting and behavioural scoring earn their place: TLS handshake characteristics, header ordering, the absence of the follow-up requests a real browser would make, and the correlation of one identical signature across hundreds of unrelated addresses.
What mitigation actually looks like
Different layers need different answers, and running only one leaves an obvious gap.
- Volumetric floods must be absorbed upstream — on a network with more capacity than the attack, before your own uplink saturates
- Protocol attacks are handled in the kernel at the edge, using connection limits and SYN cookies rather than application logic
- Application attacks require inspecting requests and separating automation from people, usually with challenges rather than outright blocks
- Caching removes a surprising share of attack traffic, because requests served from the edge never reach the origin at all
Frequently asked questions
Last updated