There are three main types of DDoS attacks: volumetric attacks, protocol attacks, and application-layer attacks. Each targets different resources, from network bandwidth and connection handling to web servers and applications.
Attackers also use techniques such as carpet-bombing, pulse-wave attacks and multi-vector attacks to make detection and mitigation more difficult.
Understanding these differences helps network operators identify what is happening during an attack and choose an appropriate response.
Table of contents
- The three main types of DDoS attacks
- Volumetric DDoS attacks
- Protocol and state-exhaustion DDoS attacks
- Application-layer DDoS attacks
- Evasive and multi-vector DDoS techniques
- How to identify the type of DDoS attack
- How FastNetMon helps detect and mitigate DDoS attacks
- Frequently asked questions
DDoS attacks explained in video format
Prefer a visual explanation? Watch Episode 2 of DDoS Decoded, where we break down the different types of DDoS attacks, how they work, and what network operators should look for when identifying them.
Continue reading for a detailed breakdown of the most common DDoS attack vectors, their characteristics, and how to defend against them.
The three main types of DDoS attacks
DDoS attacks are generally classified by the resources they attempt to exhaust.
| Attack type | What it targets | Common examples |
|---|---|---|
| Volumetric | Network bandwidth and capacity | UDP floods, ICMP floods, DNS amplification |
| Protocol / state exhaustion | Network devices, protocol processing and connection resources | SYN floods, ACK floods, connection exhaustion |
| Application layer (Layer 7) | Websites, APIs, DNS services and backend resources | HTTP floods, Slowloris, HTTP/2 Rapid Reset |
These categories can overlap. For example, a TCP flood may consume bandwidth while simultaneously overwhelming a firewall's packet-processing capacity.
The key question is: What resource is the attacker trying to exhaust?
Volumetric DDoS attacks
Volumetric DDoS attacks attempt to overwhelm a target with more traffic than its network infrastructure can handle.
They typically target internet connections, routers, firewalls or servers by consuming available bandwidth or packet-processing capacity.
Volumetric attacks are commonly measured in gigabits or terabits per second (Gbps/Tbps), although packets per second (pps) is equally important for understanding packet-processing pressure.
Common volumetric attack types
UDP floods send large volumes of UDP packets towards a target. Because UDP is connectionless, attackers can generate substantial traffic without establishing sessions.
ICMP floods, including ping floods, overwhelm networks or devices with large numbers of ICMP packets.
DNS amplification uses DNS servers to reflect responses towards a victim. Attackers send queries with the victim's spoofed source IP address, causing the servers to respond to the victim instead.
NTP amplification exploits exposed or vulnerable NTP services, historically including MONLIST functionality, to generate large reflected responses.
Memcached amplification abuses publicly accessible UDP-enabled Memcached instances, which can generate responses substantially larger than the triggering requests.
Other amplification vectors include CLDAP, SSDP, SNMP and certain legacy services. High-volume GRE and ESP packet floods can also place pressure on network infrastructure.
How amplification works
Amplification attacks are particularly disruptive because attackers can generate significantly more traffic than they send directly.
For example, an attacker sends a small request to a vulnerable public server using a spoofed source IP address. The server replies to the victim with a much larger response.
Repeated across thousands of servers, this can create an enormous incoming traffic flood.
However, not every volumetric attack uses amplification. Direct UDP and ICMP floods remain important attack vectors.
How to mitigate volumetric attacks
The most effective defences operate before attack traffic saturates the protected network connection.
Typical approaches include upstream filtering, BGP FlowSpec, DDoS scrubbing services, ACLs and Remote Triggered Black Hole (RTBH) routing.
RTBH can protect the wider network during severe attacks, but it also makes the blackholed destination unreachable.
Further reading: Understanding Volumetric & Amplification DDoS Attacks
Protocol and state-exhaustion DDoS attacks
Protocol attacks exploit the way network devices and systems process packets or manage connections.
Unlike volumetric attacks, they do not necessarily require enormous bandwidth. Instead, attackers can exhaust connection tables, packet-processing resources or protocol-handling capacity.
These attacks commonly affect Layers 3 and 4 of the OSI model.
Common protocol attack types
TCP SYN floods exploit the TCP three-way handshake. Attackers send large numbers of SYN packets without completing the connections, potentially exhausting the server's half-open connection backlog.
TCP ACK and FIN floods generate large volumes of TCP packets that can overwhelm packet-processing resources, particularly on stateful network devices.
TCP RST attacks can disrupt established connections when reset packets have valid connection information. High-volume RST floods can also consume processing resources.
Connection exhaustion attacks create or maintain large numbers of connections, placing pressure on firewalls, NAT devices, proxies and servers.
IP fragmentation attacks abuse packet fragmentation and reassembly, potentially consuming resources or triggering vulnerabilities in affected implementations.
TLS and QUIC handshake exhaustion targets the processing or state required to establish encrypted connections. These attacks can cross the boundary between transport and application infrastructure.
How to mitigate protocol attacks
Protection depends on the resource being targeted.
Common measures include SYN cookies, connection limits, appropriate timeouts, protocol hardening and upstream packet filtering.
For high packet-rate attacks, dropping malicious traffic before it reaches stateful infrastructure can be essential.
Further reading: Understanding Transport and State-Exhaustion DDoS Attacks
Application-layer DDoS attacks
Application-layer DDoS attacks, also known as Layer 7 attacks, target the services that process user requests.
Instead of overwhelming the network itself, attackers attempt to exhaust web servers, APIs, databases or other application resources.
These attacks can be difficult to detect because they may generate relatively low bandwidth while producing substantial backend load.
Common application-layer attack types
HTTP GET and POST floods overwhelm websites or APIs with requests. Attackers may target expensive operations or vary request parameters to bypass caching.
Slowloris and slow HTTP attacks keep connections open by transmitting incomplete headers or request bodies slowly, exhausting available connection or worker resources in vulnerable systems.
HTTP/2 Rapid Reset exploits HTTP/2 stream cancellation. Attackers rapidly initiate and reset request streams, creating substantial server-processing overhead. In 2023, Google reported an attack exceeding 398 million requests per second using this technique.
HTTP/2 CONTINUATION and MadeYouReset are additional examples of protocol-specific Layer 7 resource-exhaustion vulnerabilities affecting certain HTTP/2 implementations.
DNS query floods overwhelm DNS infrastructure with excessive queries. A related technique, DNS water-torture, generates large numbers of unique subdomain queries that can place pressure on authoritative DNS servers.
GraphQL and API resource exhaustion exploits expensive application operations, such as deeply nested queries, excessive field aliases or costly backend processing.
WebSocket and gRPC services may also be affected by connection, request or streaming-resource exhaustion.
How to mitigate application-layer attacks
Application-layer defence generally requires controls that understand request behaviour.
These include WAFs, application-aware rate limiting, bot detection, caching, request validation, API query limits and server-side resource controls.
Network-layer detection remains valuable for identifying accompanying volumetric or protocol attacks, but sophisticated Layer 7 threats often require dedicated application-aware protection.
Further reading: Understanding Application-Layer & Low-and-Slow DDoS Attacks
Evasive and multi-vector DDoS techniques
Not every DDoS technique fits into a separate attack category.
Some techniques are used to distribute, disguise or combine attacks across the three main categories.
Carpet-bombing attacks
Carpet-bombing distributes malicious traffic across many IP addresses, often within the same network prefix.
Instead of targeting a single host, attackers spread traffic across an entire subnet.
Individual destination traffic rates may remain below per-host detection thresholds, while aggregate traffic places significant pressure on shared infrastructure.
Detecting this behaviour requires appropriate visibility into traffic across groups of IP addresses or prefixes.
Pulse-wave attacks
Pulse-wave attacks alternate between intense bursts of traffic and quieter periods.
These patterns can be difficult to identify using long monitoring intervals or sustained-rate thresholds.
Short monitoring intervals and appropriate anomaly detection can help identify recurring attack bursts.
Multi-vector attacks
Multi-vector DDoS attacks combine several techniques.
For example, attackers might launch a UDP flood, a TCP SYN flood and an HTTP request flood during the same campaign.
Because different vectors target different resources, an effective defence strategy may require coordinated network and application-layer mitigation.
How to identify the type of DDoS attack
Different DDoS attacks produce different symptoms in network traffic and infrastructure monitoring.
| Observed symptom | Possible attack type | Important metrics |
|---|---|---|
| Very high incoming bandwidth | Volumetric flood or amplification | Bits per second (bps), protocol distribution |
| Extremely high packet rates | UDP, ICMP or TCP packet floods | Packets per second (pps), packet size, TCP flags |
| Excessive SYN traffic and failed connections | SYN flood | SYN rate, handshake completion, connection backlog |
| Connection tables approaching capacity | State exhaustion | Active connections, new connection rate, table utilisation |
| High application CPU with normal bandwidth | Layer 7 attack | Requests per second (rps), latency, CPU and error rates |
| Traffic spread across many destination IPs | Carpet-bombing | Aggregate prefix traffic, destination distribution |
| Repeated short traffic spikes | Pulse-wave attack | Short-interval traffic rates and burst patterns |
These are starting points for investigation rather than definitive signatures. Legitimate traffic spikes and infrastructure problems can sometimes produce similar symptoms.
No single traffic metric can reliably detect every type of DDoS attack.
Network operators should combine bandwidth, packet rates, protocol characteristics and traffic distribution with appropriate infrastructure and application monitoring.
How FastNetMon helps detect and mitigate DDoS attacks
FastNetMon specialises in detecting network-layer Layer 3 and Layer 4 DDoS attacks, including UDP floods, TCP floods, SYN floods, ICMP floods and amplification attacks.
FastNetMon Advanced processes traffic telemetry from sources including NetFlow, IPFIX, sFlow and mirrored packet traffic. It uses configurable thresholds and traffic analysis to identify abnormal activity affecting protected networks.
It also supports aggregate hostgroup thresholds, which can help operators identify attacks distributed across multiple IP addresses.
Depending on configuration, FastNetMon Advanced can trigger automated mitigation through:
- BGP blackholing: Rapidly discarding traffic destined for an attacked host.
- BGP FlowSpec: Generating selective IPv4 traffic-filtering rules for compatible routers.
- Traffic diversion: Integrating with upstream or cloud-based DDoS scrubbing infrastructure.
Capabilities and supported actions depend on the deployed version, IP protocol and network configuration.
FastNetMon focuses on L3/L4 traffic analysis rather than inspecting HTTP requests or application payloads. Application-layer attacks therefore require complementary controls such as WAFs and API protection.
Learn more about FastNetMon DDoS Detection and Mitigation.
Frequently asked questions
What are the most common types of DDoS attacks?
Common network-layer attack vectors include UDP floods, TCP SYN floods, ICMP floods and DNS amplification. HTTP floods are also an important application-layer attack type. Their relative prevalence varies by network, industry and reporting period.
What is the difference between Layer 3, Layer 4 and Layer 7 DDoS attacks?
Layer 3 attacks target network-layer processing and traffic delivery, such as ICMP or IP fragmentation. Layer 4 attacks involve transport protocols such as TCP and UDP. Layer 7 attacks target applications and services, including HTTP, DNS and APIs.
These layers describe where an attack operates, while volumetric, state-exhaustion and application-resource categories describe what it attempts to overwhelm.
Can a DDoS attack succeed without high bandwidth?
Yes. State-exhaustion and application-layer attacks can consume server resources, connection slots or application-processing capacity without saturating the internet connection.
Can a firewall stop every DDoS attack?
No. Firewalls can mitigate certain attacks, but they can also be overwhelmed by packet floods or connection exhaustion. Large volumetric attacks often require upstream mitigation, while application-layer attacks need application-aware controls.
Conclusion
The three main types of DDoS attacks—volumetric, protocol and application-layer—target different resources and require different detection and mitigation strategies.
Modern attacks can also combine multiple vectors or use evasive techniques such as carpet-bombing and pulse-wave modulation.
For network operators, understanding the attack type is the first step towards effective defence. The next is detecting abnormal traffic quickly and applying the appropriate mitigation before services become unavailable.
Explore FastNetMon's DDoS detection and mitigation solutions
