DDoS attack

A DDoS attack denies service by coordinating many traffic sources against one target. The sources may be compromised computers and internet-of-things devices, rented infrastructure, or systems manipulated through reflection and amplification; their geographic distribution makes simple source blocking difficult.¹ The target can be a server, an internet service provider, a domain-name service, or a particular application.

Attacks are commonly grouped as volumetric, protocol, or application-layer events. Volumetric attacks consume bandwidth; protocol attacks exhaust connection tables or processing resources in network devices; application-layer attacks send apparently valid requests that consume expensive server operations. A single incident can combine these methods, so traffic volume alone does not determine its severity.³

DDoS methods differ in how they generate load and where they apply pressure. In a direct flood, participating systems send traffic to the victim. In a reflection attack, the attacker forges the victim’s address in requests to third-party services, causing replies to converge on the victim; amplification occurs when those replies are much larger than the triggering requests.³

Well-known protocol examples include SYN floods, which consume partially established connections, and attacks against the Domain Name System, web services, or encrypted applications. Botnets made from poorly secured connected devices have expanded the pool of possible sources, while so-called low-and-slow attacks show that a modest request rate can still disrupt an application when each request is computationally costly.

Effective defense begins with distinguishing an attack from a flash crowd, a software failure, or an ordinary capacity shortage. Useful indicators include abrupt changes in source distribution, protocols, request paths, packet characteristics, error rates, and bandwidth or connection consumption. Baselines and centralized logs help responders identify which layer is failing.

Mitigation is usually distributed across several layers: upstream filtering and traffic scrubbing absorb or discard hostile traffic before it reaches the target; content-delivery networks and anycast routing spread load; rate limits, caching, queues, and resilient application design protect scarce resources. Network operators can apply filtering rules or blackholing in extreme cases, though blackholing also removes legitimate traffic. Incident plans should include provider contacts, escalation authority, evidence preservation, communication with users, and post-incident review.²

A DDoS attack does not require a large number of attackers; it requires distributed traffic or distributed resource exhaustion. A small campaign aimed at a fragile application can be more disruptive than a larger flood against a well-provisioned network. Conversely, a high-volume event may be absorbed by upstream capacity without causing an outage.

Reflection depends on intermediary systems that answer requests, so defensive work includes preventing address spoofing and securing exposed services, not only protecting the eventual victim.³ DDoS activity can also serve as a diversion while an intruder pursues another objective, although the denial-of-service component itself does not prove that data was accessed. Security frameworks classify denial-of-service as an adversary technique, while incident responders generally treat availability, integrity, and confidentiality as separate questions.⁴

Botnet

A network of compromised or otherwise controlled devices that can receive coordinated commands.

Reflection

A technique that causes third-party systems to send responses toward the intended victim, often using a falsified source address.

Amplification

A property of an attack in which a small request produces a disproportionately large response.

Traffic scrubbing

Filtering and forwarding service that removes suspected malicious traffic before legitimate traffic reaches a protected target.

Anycast

A routing method in which the same network address is announced from multiple locations, helping distribute incoming traffic.