A DDoS (Distributed Denial of Service) attack is a cyberattack that attempts to make a website, server, network, or online service unavailable by overwhelming it with traffic or requests from many sources at the same time.
Unlike attacks designed to gain unauthorised access or steal data, a DDoS attack primarily targets availability. The goal is to consume enough bandwidth, network capacity, or computing resources that legitimate users can no longer access the targeted service normally.
In simple terms, a DDoS attack is like creating an artificial traffic jam around an online service: the service may still be running, but legitimate users cannot reliably reach it.
DDoS explained in 30 seconds
A typical DDoS attack works like this:
- An attacker controls or coordinates many Internet-connected devices.
- Those devices send traffic or requests toward the same target.
- The attack consumes bandwidth or infrastructure resources.
- Legitimate traffic has to compete with the attack traffic.
- The targeted service becomes slow, unstable, or unavailable.
The word distributed is important. Instead of the attack coming from a single source, traffic can originate from thousands of devices, IP addresses, and networks at once. This makes DDoS attacks more difficult to stop with simple source-based blocking.
How does a DDoS attack work?
Many DDoS attacks use a botnet — a collection of compromised computers, servers, routers, IoT devices, or other Internet-connected systems that an attacker can remotely control.
The owners of these devices may not know that their systems are participating in an attack.
When the attack begins, the compromised devices simultaneously generate traffic toward the target. Depending on the attack technique, the objective may be to:
- Saturate the target's Internet bandwidth
- Overwhelm routers, firewalls, or load balancers
- Exhaust connection tables or other infrastructure resources
- Consume server CPU or memory
- Overload a website, API, or application with requests
Some DDoS attacks also use reflection and amplification, where third-party Internet services are abused to send large amounts of traffic toward the victim.
Regardless of the technique, the objective is the same: consume resources needed by legitimate users until the service becomes degraded or unavailable.
DoS vs. DDoS: what's the difference?
The main difference between DoS and DDoS is the number and distribution of systems generating the attack.
| DoS attack | DDoS attack |
|---|---|
| Denial of Service | Distributed Denial of Service |
| Usually originates from one or relatively few sources | Originates from many distributed sources |
| Often easier to identify and block | Usually harder to block using source-based filtering |
| Limited by the resources of the attacking system | Can combine the resources of many devices |
A DoS attack attempts to deny access to a service. A DDoS attack does the same thing using distributed sources.
What are the main types of DDoS attacks?
DDoS attacks are commonly divided into three broad categories: volumetric attacks, protocol attacks, and application-layer attacks.
1. Volumetric attacks
A volumetric DDoS attack attempts to consume the available bandwidth between a target and the Internet.
Common examples include:
- UDP floods
- ICMP floods
- DNS amplification attacks
- NTP amplification attacks
These attacks are often measured in bits per second (bps), such as Gbps or Tbps.
2. Protocol attacks
Protocol attacks target network protocols or the infrastructure responsible for processing connections.
Instead of relying only on bandwidth, they may attempt to exhaust resources such as connection tables or packet-processing capacity.
A TCP SYN flood is a common example.
These attacks are often associated with high packets-per-second (pps) or connection rates.
3. Application-layer attacks
Application-layer attacks target applications and services, typically at Layer 7 of the OSI model.
For example, an attacker may generate large numbers of HTTP requests toward a website or API. Individual requests may appear legitimate while collectively consuming substantial application or backend resources.
An HTTP flood is a common example of an application-layer DDoS attack.
These three categories are a good starting point to understand the types of DDoS attacks, but if you want to dig deeper, here is a full taxonomy of DDoS attacks.
What does a DDoS attack look like in real network traffic?
In real network traffic, a DDoS attack often appears as a sudden and significant deviation from the network's normal traffic baseline.
The example below, captured using FastNetMon LiveView, shows how a DDoS attack can appear in network traffic.
Example of DDoS attack traffic illustrated in FastNetMon LiveView, showing a sudden increase above the normal traffic baseline.
Before the attack begins, network traffic remains within its expected range. When the attack starts, traffic rises sharply as packets are directed toward the target.
Network operators typically examine several metrics:
- Bits per second (bps): the amount of bandwidth being consumed
- Packets per second (pps): the number of packets the network must process each second
- Flows per second (fps): the rate at which network flows are observed
- Source and destination addresses: where traffic originates and which systems are targeted
- Protocols and ports: what types of network traffic are involved
A large traffic spike does not automatically mean DDoS. Legitimate events can also cause sudden increases in traffic.
The important question is whether the traffic represents an abnormal change from the network's expected behavior. This is why understanding the normal traffic baseline is important for accurate DDoS detection.
How can you tell if you're under a DDoS attack?
Common indicators of a possible DDoS attack include:
- Sudden, unexpected increases in network traffic
- Abnormally high packet rates
- Large numbers of connections or requests
- Significant deviations from normal traffic patterns
- Unusual protocols, ports, sources, or destinations
- Increased network latency
- Packet loss
- Websites or APIs becoming slow
- Connection timeouts
- Complete service outages
No single symptom proves that a DDoS attack is taking place. Detection requires traffic visibility and context so abnormal activity can be distinguished from legitimate traffic spikes.
How are DDoS attacks detected and mitigated?
DDoS detection starts with monitoring network traffic and identifying behavior that differs significantly from what is expected.
Network operators typically collect traffic telemetry using technologies such as:
- NetFlow
- IPFIX
- sFlow
- Packet data
- Network and routing telemetry
DDoS detection software such as FastNetMon analyses this traffic in real time, looking for abnormal traffic volumes, packet rates, and other patterns that may indicate an attack.
Once an attack is detected, the next step is mitigation: taking action to stop or limit the malicious traffic while minimising the impact on legitimate users.
Common DDoS mitigation techniques include:
- BGP FlowSpec to apply targeted filtering rules
- BGP Blackhole / RTBH to discard traffic destined for an attacked host or network
- Traffic redirection to an external DDoS scrubbing center
- Rate limiting and traffic filtering
- Firewall or access-control rules
Network operators can also use software such as FastNetMon to automate the response. For example, when an attack crosses operator-defined thresholds, FastNetMon can trigger BGP FlowSpec filtering, announce an RTBH route, or redirect traffic toward an external mitigation system.
This automation reduces the time between detecting an attack and beginning mitigation, which is particularly important during fast-growing volumetric DDoS attacks.
Detection and mitigation therefore perform different jobs: detection identifies and characterizes the attack; mitigation takes action against the malicious traffic.
Frequently asked questions about DDoS attacks
What does DDoS stand for?
DDoS stands for Distributed Denial of Service. It describes an attack that uses multiple distributed sources to overwhelm a network, server, application, or online service and make it unavailable to legitimate users.
What is a DDoS attack in simple terms?
A DDoS attack overwhelms an online service with traffic or requests from many sources at once. The resulting overload can prevent legitimate users from accessing the service.
What are the three main types of DDoS attacks?
The three broad categories are:
- Volumetric attacks — consume network bandwidth
- Protocol attacks — exhaust network or infrastructure resources
- Application-layer attacks — overwhelm applications or services with requests
Real-world attacks can combine techniques from more than one category.
Does a DDoS attack steal data?
A DDoS attack does not inherently steal data. Its primary objective is to disrupt the availability of a service.
However, organizations should still investigate DDoS incidents carefully rather than assume that denial of service is the only malicious activity taking place.
Can a firewall stop a DDoS attack?
A firewall can help mitigate some DDoS attacks, but a firewall alone cannot provide complete DDoS protection.
If an attack saturates the Internet connection before traffic reaches the firewall, filtering the traffic at the firewall cannot restore the lost bandwidth. Firewalls can also become targets themselves when attacks exhaust connection tables or processing resources.
Can DDoS attacks be prevented?
It is generally not possible to prevent attackers from sending malicious traffic toward an Internet-facing service.
Instead, DDoS protection focuses on detecting attacks quickly, filtering or absorbing malicious traffic, and maintaining availability for legitimate users.
