DDoS attacks are commonly classified into three main types: volumetric attacks, protocol attacks, and application-layer attacks. Each category targets different resources, from network bandwidth and connection-handling capacity to web application processing.
Understanding these differences helps organizations recognize attack symptoms and select appropriate protection methods. The comparison below explains how each type works, its common attack vectors, and the resources it affects.
3 Types of DDoS Attacks
In the following sections, we’ll break down the three primary types of DDoS attacks: volumetric, protocol, and application-layer DDoS attacks.
| Type | What It Targets | Common Examples | Main Indicator |
|---|---|---|---|
| Volumetric | Bandwidth | UDP Flood, DNS Amplification | Bps |
| Protocol | Network or Connection Resources | SYN Flood, TCP Flood | PPS, Connection States |
| Application Layer | Web Applications and APIs | HTTP Flood, Slowloris | RPS, Latency, CPU |
1. Volumetric DDoS Attacks
Volumetric DDoS attacks aim to saturate a target’s available bandwidth by flooding it with massive amounts of traffic. Volumetric DDoS attacks do not rely on protocol exploitation but instead overwhelm the network infrastructure with sheer scale. User Datagram Protocol (UDP) floods and Internet Control Message Protocol (ICMP) floods are two common forms of volumetric attacks, with DNS amplification attacks being a well-known variation of the UDP flood. These attacks can also trigger secondary effects, such as network congestion and collateral impact on connected services.
UDP Flood
A UDP flood aims to render a system, server, or bandwidth unavailable by overwhelming it with a large volume of User Datagram Protocol (UDP) packets. Since UDP is a connectionless protocol that does not require a handshake or integrity check, attackers can easily overwhelm a target with a high volume of packets using relatively few resources. This makes UDP floods especially effective at exhausting network or server capacity. Attackers can further exploit the UDP format to skip integrity checks and generate amplification and reflection attacks.
A prominent example is DNS amplification, where a small query with a spoofed IP address of the victim triggers a much larger response from open DNS servers, amplifying the attack traffic and overwhelming the target with disproportionate force. This type of amplification underscores how attackers can multiply their impact without increasing the number of devices in the botnet, highlighting the efficiency of volumetric attacks.
ICMP Flood
An ICMP flood targets ICMP, which is typically used for network diagnostics and error reporting. In an ICMP attack, attackers overwhelm a system by sending a large volume of Echo Request (ping) packets, often with spoofed IP addresses. The targeted network is forced to process these requests and generate Echo Replies, consuming CPU, memory, and bandwidth until performance degrades or services become unavailable. Because ICMP traffic is commonly used for legitimate purposes, distinguishing malicious floods from normal diagnostic activity is challenging, making ICMP floods simple to execute yet highly disruptive.
Smurf Attack
A Smurf attack is an ICMP-based reflection and amplification attack that can overwhelm a target with large volumes of traffic. The attacker sends ICMP Echo Requests to a network’s directed broadcast address while spoofing the victim’s IP address as the source. If the network permits directed broadcasts and multiple hosts respond, those replies are sent to the victim, amplifying the incoming traffic.
Smurf attacks are commonly associated with volumetric DDoS attacks because the amplified ICMP responses can consume substantial bandwidth and packet-processing resources. Modern networks typically restrict directed broadcasts, reducing exposure to this attack method.
2. Protocol DDoS Attacks
Protocol DDoS attacks target the resources that network devices and servers use to process packets and manage connections. Rather than relying solely on high traffic volume, these attacks exploit protocol behaviors to exhaust TCP connection tables, SYN backlogs, packet-processing capacity, or the resources used by firewalls and load balancers. As a result, legitimate users may experience connection timeouts, degraded performance, or service outages even when network bandwidth is not fully saturated.
For example, a SYN flood sends large numbers of TCP connection requests without completing the three-way handshake, potentially exhausting resources allocated to half-open connections. Other protocol-based attacks can overwhelm packet-processing or IP fragment-reassembly resources. Common examples include SYN floods, TCP floods, and IP fragmentation attacks:
SYN Flood
A SYN flood attack is one of the most common types of protocol DDoS attacks. It exploits the TCP handshake process, where a client sends a SYN packet to initiate a connection. The attacker sends a large number of SYN requests but never completes the handshake with the final ACK. As a result, the target servers keep these half-open sessions active, exhausting server resources until they can no longer handle legitimate traffic.
TCP Flood
In a TCP flood, attackers overwhelm web servers by sending a massive volume of TCP packets—either valid or malformed—directly to the targets. Unlike SYN floods, which exploit incomplete handshakes, TCP floods overwhelm the server with constant malicious traffic that forces it to process every incoming request. This relentless processing rapidly exhausts server resources such as CPU, memory, and bandwidth, eventually degrading server performance or making the server completely unavailable.
IP Fragmentation Attack
An IP fragmentation attack targets the IP protocol, which is used for routing packets across networks. In an IP fragmentation attack, the attacker deliberately sends specially crafted, fragmented packets to the target system or network. These abnormal fragments force the target system or network to use excessive resources to reassemble the original packets, potentially leading to resource exhaustion and degraded network performance.
3. Application-Layer DDoS Attacks
Application-layer DDoS attacks (Layer 7) target the top layer of the OSI model, encompassing services like email, web browsing, file transfer, database access, and other network applications. Unlike lower-layer attacks that aim at bandwidth or protocol weaknesses, these target the application itself by overwhelming it with seemingly legitimate requests, making it harder to detect.
Because the application layer interfaces directly with users, disruptions here can quickly affect user experience, trust, and revenue streams. The application layer is increasingly becoming the main target of DDoS attacks, given its critical role in delivering services to end users. Common types of application-layer DDoS attacks include:
Slowloris
An HTTP slow attack (also known as a Slowloris Attack) targets web servers by exploiting a vulnerability in the HTTP protocol. The attack works by sending a large number of incomplete HTTP requests and keeping them open for as long as possible, preventing the server from processing other legitimate traffic.
HTTP Flood Attacks
An HTTP flood attack is a type of cyber attack that targets web servers or applications by flooding them with a high volume of HTTP requests to overwhelm the server and make it unavailable to legitimate users. The high volume of malicious traffic can exhaust the server’s resources, such as CPU, memory, and network bandwidth, causing the server to slow down or crash. These attacks often mimic legitimate user behavior, which complicates detection and requires advanced mitigation strategies that can differentiate normal and malicious traffic.
Emerging or Sophisticated Types of DDoS Attacks
As DDoS attacks continue to evolve, attackers are relying less on single-vector floods and more on layered strategies that target different weaknesses simultaneously.
The emerging types of DDoS attacks demonstrate how adversaries are shifting toward greater sophistication, scale, and persistence. They also often combine multiple vectors to maximize disruption, requiring organizations to adopt adaptive mitigation strategies.
Multi-Vector Attacks
One of the most prominent trends in modern cyberattacks is the increasing prevalence of multi-vector attacks, in which adversaries combine techniques such as volumetric floods, protocol exploits, and application-layer disruptions. These methods can be launched in sequence or in parallel, making it harder for defenders to distinguish malicious traffic from normal patterns.
By forcing defenders to manage overlapping tactics, the attack greatly increases the likelihood of disrupting legitimate traffic and degrading service availability. Such attacks also complicate real-time traffic monitoring and make mitigation decisions more resource-intensive.
Botnet-Powered Attacks
A DDoS botnet coordinates distributed devices or systems to generate attack traffic against a target.
Botnets remain a cornerstone of large-scale DDoS attacks, but the composition of these networks is shifting. While traditional IoT botnets continue to operate, attackers are increasingly leveraging virtual private servers (VPS) and other cloud-based resources to generate more powerful attacks. Cloud-based botnets offer higher throughput and shorter spin-up times, allowing large numbers of malicious requests to strike target servers with concentrated force.
By combining vast numbers of distributed machines with cloud-scale capacity, such botnet-powered attacks can sustain pressure on target servers far longer than traditional denial-of-service attempts.
Application-Specific Exploits
Application-layer vectors are becoming increasingly precise, targeting APIs and even specific protocol features. A notable example is the HTTP/2 rapid reset vulnerability, which exploits the protocol’s stream multiplexing and RST_STREAM features.
By rapidly opening and canceling large numbers of streams, attackers force the target server to repeatedly allocate CPU and memory, creating significant strain and degrading availability. In parallel, low-and-slow attacks, in which requests are deliberately trickled in just slow enough to keep connections open, remain effective.
Although low-and-slow attacks require relatively few resources from the attackers, they can tie up critical network resources and block legitimate traffic, demonstrating how both modern and traditional methods continue to challenge defenses at the application layer.
The Damage Caused by DDoS Attacks
The impact of a DDoS attack extends far beyond temporary service disruptions. It directly impacts business continuity and user trust. By overwhelming web servers and critical network resources with massive volumes of malicious traffic, attackers render systems incapable of serving legitimate users. This results in outage, degraded performance, and abandoned customer sessions.
Yet the impact does not stop at the technical level. Prolonged or repeated disruptions directly translate into financial risk, including lost revenue opportunities, rising operational costs, and long-term damage to brand reputation. The financial impact of downtime has therefore become a critical concern for modern organizations.
According to research by ITIC, most enterprises report that the cost of downtime exceeds $300,000 per hour. For some organizations, particularly those with highly critical systems, losses can rapidly escalate into the millions per hour. For organizations dependent on continuous digital services, even a brief disruption can result in disproportionate risk. This risk is amplified by the fact that attackers are constantly evolving their methods.
The rising sophistication of DDoS attacks adds another dimension of pressure. Beyond straining IT teams, these incidents siphon resources from strategic projects, trapping organizations in a costly cycle of defense and recovery. The demand to keep services running during such attacks intensifies operational stress and increases the likelihood of human error in response.
This combination of resource drain, mounting costs, and human factors underscores the urgency of proactive defense, making robust mitigation strategies a necessity rather than an option.
DDoS Mitigation
Effective DDoS mitigation begins with early detection and continuous visibility into network traffic. Organizations should monitor for anomalies such as sudden surges in traffic, repeated requests from clients with similar attributes, and other indicators of abnormal load. Proactive traffic monitoring and analysis are critical to identifying threats before they escalate and ensuring that legitimate users remain unaffected.
To strengthen resilience, many organizations turn to cloud-based DDoS protection platforms such as CDNetworks’ Flood Shield 2.0.
Operating between origin infrastructure and the public internet, Flood Shield 2.0 delivers real-time mitigation through layered defenses, including rate limiting, port limiting, and threat intelligence. These capabilities provide robust protection across all major attack vectors, reducing risk and ensuring service availability even during large-scale DDoS attacks.
Sign up for a free trial or read the product brochure to learn more about our DDoS mitigation platform.