What is DDoS (Distributed Denial of Service)?

DDoS attacks cluster into three broad categories that target different layers of the stack. Volumetric attacks aim to saturate available bandwidth outright, often using reflection and amplification, where an attacker spoofs the target's source IP and sends small requests to open DNS resolvers, NTP servers, or misconfigured memcached instances, each of which replies with a response many times larger than the request, multiplying the traffic that lands on the victim. Protocol attacks target the connection-handling logic of network infrastructure itself, the classic example being a SYN flood that opens huge numbers of half-finished TCP handshakes to exhaust a server's or firewall's connection state table without ever completing a real session. Application-layer attacks operate at Layer 7, sending traffic that looks like legitimate requests, HTTP GET floods against a specific expensive endpoint, or a Slowloris-style attack that opens many connections and sends data slowly enough to hold worker threads open indefinitely, both of which can take a service down with far less raw bandwidth than a volumetric attack requires.

The distributed sources behind large attacks are usually a botnet, a network of compromised devices under a single attacker's control. The Mirai botnet, built from poorly secured IoT devices like consumer routers and cameras, demonstrated how large these networks can get and how much traffic they can generate, and Mirai-derived variants remain active in the DDoS-for-hire market years later.

Mitigation is layered by attack type. Upstream scrubbing services (Cloudflare, Akamai, AWS Shield) absorb and filter volumetric traffic before it ever reaches the origin network, typically using anycast routing to spread the flood across globally distributed scrubbing centers. SYN cookies let network infrastructure survive protocol-level floods without exhausting connection state. CDN and WAF layers absorb application-layer floods by caching content and applying rate limiting and bot-detection logic closer to the client. At the network provider level, remotely triggered black hole (RTBH) routing lets an ISP null-route traffic destined for a specific IP under sustained volumetric attack, sacrificing that one destination's availability to protect the rest of the network.