Last updated: 2026-08-21
A DDoS attack is a denial-of-service attack launched from multiple distributed sources (often a botnet) to overwhelm a target’s bandwidth or resources. The outcome is service degradation or outage for legitimate users due to resource exhaustion at the network, protocol, or application layer.
TL;DR: A DDoS (Distributed Denial of Service) attack floods a target — website, API, DNS server — with traffic from thousands of compromised devices simultaneously. Unlike a single-source DoS attack, the distributed origin makes blocking by IP alone ineffective. Defense requires multi-layer mitigation: network-level scrubbing for volumetric floods, protocol-state protection for SYN floods, and a WAF or rate limiting for application-layer attacks.
You can categorize DDoS attacks into three main types:
- Volumetric Attacks: The objective of these attacks is to exhaust the bandwidth of the targeted infrastructure by inundating it with a huge volume of traffic, like UDP floods, ICMP floods, and spoofed-packet floods.
- Protocol Attacks: Also known as state-exhaustion attacks, these target network layer and transport layer protocols, exploiting vulnerabilities to deplete server resources. SYN floods, Ping of Death, and “Smurf” DDoS attacks are some examples.
- Application Layer Attacks: These attacks target vulnerabilities in Layer 7 (application layer) protocols, such as HTTP floods, Slow Loris attacks, and DNS query floods, to crash the web server.
What Are the Differences Between DoS and DDoS Attacks?
A DoS attack originates from one source attempting to overwhelm a target. A DDoS attack originates from many distributed sources, making it harder to block and easier to generate large-scale traffic.
How a DDoS attack works
- An attacker compromises or rents access to many devices (a botnet) or uses multiple systems to generate traffic.
- Those sources send large volumes of requests/packets toward a target (IP, DNS, website, API, or upstream provider).
- The target (or its upstream links) hits capacity limits—bandwidth, connection tables, CPU, memory, or application threads.
- Legitimate traffic is delayed, dropped, or cannot connect at all.
Types of DDoS attacks (by target layer)
| Type | What it tries to exhaust | Common examples | What it looks like |
|---|---|---|---|
| Volumetric | Bandwidth / link capacity | UDP floods, ICMP floods, spoofed floods | Huge spikes in Mbps/Gbps |
| Protocol (state exhaustion) | Network/protocol state tables | SYN floods, Smurf, Ping of Death | Many half-open connections, device CPU spikes |
| Application layer (L7) | App resources (threads, DB, cache) | HTTP floods, Slowloris, DNS query floods | Normal-looking requests, high RPS, app latency climbs |
Note: Real incidents often combine multiple vectors (e.g., volumetric diversion + L7 targeting).
When to use DDoS protection
Use DDoS protection when you:
-
Operate internet-facing websites, APIs, DNS, or login/checkout flows.
-
Have availability SLAs (or revenue depends on uptime).
-
Have experienced traffic spikes you can’t confidently classify as legitimate.
-
Need protection against multi-vector attacks (L3/4 + L7).
-
Want to reduce downtime risk without overprovisioning infrastructure.
What Are the Motivations Behind DDoS Attacks?
The motivations behind DDoS attacks are diverse and can range from financial gain to ideological beliefs. Some of the most common reasons attackers launch DDoS attacks include financial gain, hacktivism, cyberwarfare, personal reasons, and testing and experimentation.
Cybercriminals may use DDoS attacks as a means of extortion, demanding ransom payments from targeted organizations in exchange for ceasing the attack. They may also launch attacks to disrupt competitors’ services and gain an unfair advantage in the market.
Hacktivists often employ DDoS attacks as a form of protest or to draw attention to their political or social causes. Hacktivists target government agencies, corporations, or individuals perceived to be acting against their beliefs with these attacks.
Nation-states may engage in DDoS attacks as part of their cyberwarfare strategies, targeting critical infrastructure, financial institutions, or government agencies of rival nations to cause disruption and damage.
In some cases, individuals may launch DDoS attacks as a form of revenge, harassment, or cyberbullying against specific targets, such as former employers, competitors, or personal enemies. Some attackers may also conduct DDoS attacks as a means of testing their own capabilities, experimenting with new attack techniques, or assessing the resilience of their own infrastructure.
What Are the Impacts of DDoS Attacks?
Successful DDoS attacks can have severe consequences for organizations, including:
- Downtime and revenue loss (direct impact on sales, signups, and operations)
- Operational costs (incident response, emergency scaling, mitigation services)
- Customer trust damage (reliability perception, churn risk)
- Security distraction (DDoS used as a smokescreen for other intrusions)
What Are Some Strategies for DDoS Protection and Mitigation?
Protection and mitigation go hand in hand when dealing with DDoS attacks. The former strategies aim to prevent attacks, while the latter focuses on reducing or eliminating the impact of an attack if it occurs.
DDoS protection includes the development of a comprehensive DDoS Response Plan, the conduction of regular risk assessments, the implementation of multi-layered security measures, the constant monitoring of network traffic, the use of edge-based protection services and the education and training of employees.
Effective DDoS mitigation strategies include the use of firewalls and intrusion prevention systems, the implementation of load balancing and redundancy on your network infrastructure, rate limiting and IP blocking, and traffic scrubbing.
Frequently Asked Questions
What is a DDoS attack in simple terms? A DDoS attack is a coordinated attempt by hundreds or thousands of machines to overwhelm a server, network, or application with traffic so that legitimate users cannot access it. The “distributed” part means blocking one source IP is not enough to stop the attack.
How do I know if I’m under a DDoS attack or just getting more users? A DDoS typically shows abnormal patterns — sudden traffic spikes from unusual geographies or ASNs, repeated requests to the same endpoints, high error rates, and rising latency — without corresponding business signals like sales or signups increasing. Legitimate traffic spikes correlate with events; DDoS spikes do not.
What’s the most common DDoS attack type? Volumetric floods are the most frequent, but modern attacks increasingly combine multiple vectors: volumetric pressure at L3/L4 to exhaust upstream links while simultaneously targeting L7 with application-layer floods designed to exhaust application threads or database connections.
Can a WAF stop a DDoS attack? A WAF helps most at the application layer (L7) — it can rate-limit, challenge, or block suspicious HTTP request patterns. Large volumetric or protocol-state floods operate below the application layer and require network-layer DDoS mitigation at the edge before traffic even reaches your WAF.
What should I measure during a DDoS incident? Monitor bandwidth (bps), packet rate (pps), requests per second by endpoint, open connection counts, error rates (4xx/5xx), and p95/p99 latency — as well as mitigation effectiveness (blocked vs. passed traffic) and false-positive rates to avoid blocking legitimate users.
What is the difference between DDoS and a botnet? A botnet is the infrastructure — a network of compromised devices under attacker control. A DDoS attack is one of the operations that botnet can execute. The same botnet can also be used for spam campaigns, credential stuffing, or cryptomining.
How long does a DDoS attack typically last? Attack durations vary widely. Short burst attacks last under 10 minutes and are designed to probe defenses or cause brief disruptions. Sustained attacks can run for hours or days, especially when extortion, protest activity, or repeated probing is involved.
Sources
- CISA. “Understanding and Responding to Distributed Denial-of-Service Attacks.”
- CISA. “Understanding and Responding to Distributed Denial-of-Service Attacks.”
- NIST. “Guide to Intrusion Detection and Prevention Systems.” SP 800-94.
- NIST. “Guide to Intrusion Detection and Prevention Systems.” SP 800-94.
Conclusion
As DDoS attacks continue to evolve in scale and complexity, organizations must remain vigilant and proactive in their cybersecurity efforts. By implementing a comprehensive, multi-layered approach to DDoS mitigation, organizations can enhance their resilience against these threats and minimize the impact on their operations and customers.
Staying informed about the latest DDoS attack trends, mitigation techniques, and best practices, organizations can strengthen their cybersecurity posture and maintain the availability, integrity, and resilience of their online services in the face of distributed denial-of-service attacks.