Table of Contents
A Distributed Denial of Service, or DDoS, attack is a cyberattack that uses traffic from multiple sources to overwhelm a website, network, server, application, or online service. By exhausting available bandwidth, connection capacity, or computing resources, the attack prevents legitimate users from accessing the targeted service.
A simple way to visualize a DDoS attack is to imagine a store with one entrance and limited staff. Under normal conditions, genuine customers can enter and receive service. During a DDoS attack, thousands of coordinated visitors arrive at the same time, block the entrance, and occupy every employee with meaningless requests. The store remains physically intact, but real customers can no longer get inside or receive assistance.
Unlike a conventional denial-of-service attack that may originate from one source, a DDoS attack distributes malicious traffic across numerous devices or systems. This makes the attack larger, more resilient, and more difficult to block using individual IP addresses.
DDoS attacks at a glance
| Attribute | Description |
|---|---|
| Full name | Distributed Denial of Service |
| Primary objective | Make a service slow, unstable, or unavailable |
| Traffic sources | Multiple distributed devices, servers, networks, or reflected services |
| Common targets | Websites, APIs, networks, DNS services, applications, and online platforms |
| Main categories | Volumetric, protocol, and application-layer attacks |
| Typical impact | Downtime, latency, lost transactions, operational disruption, and reputational damage |
| Primary security concern | Availability |
What is the purpose of a DDoS attack?
The primary purpose of a DDoS attack is to disrupt availability.
Attackers attempt to make a digital service inaccessible or unreliable by consuming the resources required to serve legitimate users. Depending on the target, this may affect a public website, customer portal, payment system, gaming platform, application programming interface, or an organization’s wider network infrastructure.
Common motivations include:
-
Financial extortion:
Attackers demand payment in exchange for stopping an ongoing attack or avoiding a threatened attack. -
Business disruption:
An attack is timed to interfere with a product launch, promotion, live event, or another commercially important period. -
Ideological or political activity:
A group attempts to take a public-facing service offline to attract attention or express opposition. -
Competitive interference:
An attacker attempts to damage another organization’s availability, revenue, or customer experience. -
Diversion:
The DDoS attack creates operational noise while another malicious activity is attempted elsewhere.
A DDoS attack primarily targets availability rather than directly accessing or extracting information. However, organizations should still investigate surrounding activity because a service disruption may occur alongside other security threats.
How does a DDoS attack work?
Most DDoS attacks work by coordinating traffic from many distributed sources and directing that traffic toward the same target.
A typical attack follows four broad stages.
1. Devices or systems are assembled
Attackers may compromise vulnerable computers, routers, Internet of Things devices, cloud servers, or other internet-connected systems. These compromised devices form a remotely controlled network commonly known as a botnet.
Attackers may also use reflection techniques that cause third-party servers to send responses toward the victim.
2. The attack is coordinated
The attacker instructs the distributed systems to target a particular domain, IP address, application, API endpoint, or network service. The instructions may specify the attack method, intensity, and duration.
3. Traffic is generated
The participating systems simultaneously send packets, connection requests, or application requests toward the target.
In a reflection or amplification attack, the attacker sends requests to intermediary services using the victim’s IP address. Those services then direct their responses toward the victim, increasing the volume of attack traffic.
4. Resources become exhausted
As malicious traffic accumulates, the target may run out of bandwidth, connection capacity, CPU, memory, database connections, or application-processing capacity.
Legitimate users then experience slow performance, errors, timeouts, or complete service unavailability.
What are the main types of DDoS attacks?
DDoS attacks are commonly divided into three broad categories according to the resources and infrastructure layers they target.
| DDoS attack type | Primary target | Common examples | Common measurement |
|---|---|---|---|
| Volumetric | Network bandwidth | UDP floods, ICMP floods, and DNS amplification | Bits per second |
| Protocol | Connection tables, network devices, and protocol resources | SYN floods, ACK floods, and fragmentation attacks | Packets per second |
| Application layer | Websites, applications, APIs, and backend services | HTTP GET or POST floods and Slowloris | Requests per second |
Volumetric DDoS Attacks
A volumetric DDoS attack attempts to saturate the target’s available network capacity with a large quantity of traffic.
Even when the origin infrastructure is functioning correctly, legitimate traffic may be unable to reach it because the surrounding network links are congested.
Common examples include:
Protocol DDoS Attacks
A protocol attack exhausts the systems responsible for handling packets, sessions, or connections.
Rather than relying solely on bandwidth consumption, the attack exploits how network and transport protocols allocate and maintain finite resources.
A SYN flood, for example, attempts to consume connection capacity by creating large numbers of incomplete connections. Common examples include:
- SYN flood attacks
- ACK flood attacks
- TCP flood attacks
- Fragmentation attacks
Application-Layer DDoS Attacks
An application-layer, or Layer 7, DDoS attack targets websites, APIs, login systems, search functions, and other application processes.
The requests may appear technically valid and can resemble genuine user activity. However, at scale, they can consume significant CPU, memory, database, or application-processing capacity. Common examples include:
- HTTP GET and POST flood attacks
- Slowloris attacks
- XML-RPC flood attacks
- WordPress login flood attacks
Explore the types of DDoS attacks for detailed explanations of UDP floods, DNS amplification, SYN floods, HTTP floods, Slowloris, and multi-vector attacks.
What is the difference between DoS and DDoS?
DoS and DDoS attacks share the same general objective. Both attempt to degrade or interrupt the availability of a system or service.
The main difference is the distribution of the attack sources.
| Characteristic | DoS attack | DDoS attack |
|---|---|---|
| Number of sources | Usually one or a limited number | Many distributed sources |
| Traffic distribution | More concentrated | Distributed across devices, networks, or intermediary services |
| Potential scale | Generally more limited | Can reach very large volumes |
| IP-based blocking | Often more practical | More difficult because traffic comes from many sources |
| Mitigation complexity | Usually lower | Usually higher |
| Attack resilience | Easier to disrupt at the source | More difficult to stop by blocking individual sources |
Because DDoS traffic is distributed, defenders must distinguish malicious activity from legitimate traffic arriving from many different locations. Blocking one source rarely stops the overall campaign.
What are the signs of a DDoS attack?
A DDoS attack may initially resemble a traffic surge, system fault, application problem, or network outage.
The strongest indication is usually a combination of abnormal traffic behavior and resource pressure that cannot be explained by legitimate business activity.
-
Unexpected traffic spikes:
Bandwidth, packet volume, connection attempts, or request rates increase rapidly without a corresponding campaign, event, or customer activity. -
Slow or unavailable services:
Users experience higher latency, failed connections, error responses, loading problems, or complete service unavailability. -
Resource exhaustion:
Network capacity, CPU, memory, database connections, or connection tables remain at unusually high levels. -
Repeated requests to specific resources:
A login page, search function, product page, API endpoint, or another resource receives a disproportionate number of repeated requests. -
Highly distributed traffic:
A large amount of similar traffic arrives from many IP addresses, networks, devices, or geographic locations. -
Unusual protocol or request patterns:
Security teams may observe malformed packets, incomplete connections, unexpected request headers, abnormal user-agent patterns, or sudden increases in requests that are expensive for the application to process.
No single signal confirms every attack. Detection requires comparing current activity with the organization’s normal traffic baseline and examining behavior across the network, transport, and application layers.
A real-world DDoS attack example
In a customer case analysis, we responded to a ransom DDoS campaign targeting a major software download platform.
The largest attack observed during the campaign peaked at 1.01 Tbps and primarily combined SYN flood and ACK flood traffic directed at the customer’s origin infrastructure. The broader campaign continued for more than one month.
CDNetworks activated Flood Shield 2.0 and filtered the malicious traffic before it could disrupt the customer’s service. The platform remained operational during the campaign and experienced no downtime after the protection service was activated.
This example illustrates several characteristics of modern DDoS campaigns:
- An attack may use multiple vectors rather than one fixed technique.
- Attack intensity can change over the course of a campaign.
- Attackers may combine technical disruption with an extortion demand.
- Large attacks often need to be mitigated upstream, before the traffic reaches the origin.
- Protection must preserve legitimate traffic while filtering malicious activity.
Read the complete 1.01 Tbps ransom DDoS attack analysis.
How are DDoS attacks stopped and prevented?
Responding to an active DDoS attack generally involves identifying the affected service, analyzing the attack traffic, filtering malicious requests or packets, and protecting the target from resource exhaustion.
For high-volume attacks, traffic may need to be redirected to distributed mitigation infrastructure or scrubbing centers before it reaches the origin. Application-layer attacks may require behavioral analysis, rate controls, web application firewall policies, bot management, and protection rules designed around specific endpoints.
The appropriate response depends on whether the immediate objective is to stop an active incident, prepare infrastructure before an attack, or deploy a broader mitigation service.
During an active attack
Organizations should follow an incident response process that confirms the attack, identifies affected assets, activates filtering or scrubbing, protects critical services, and coordinates with network and security providers.
Follow the complete guide on how to stop a DDoS attack.
Before an attack
Preparation may include traffic baselining, monitoring, redundant infrastructure, protected origin addresses, capacity planning, escalation procedures, and a documented response plan.
Review practical measures for how to prevent a DDoS attack.
Through a DDoS mitigation service
A mitigation service may provide detection, traffic diversion, filtering, distributed scrubbing, application protection, and ongoing attack analysis.
Learn what DDoS mitigation is and how it works.
How CDNetworks helps protect against DDoS attacks
CDNetworks Flood Shield 2.0 is a cloud-based DDoS mitigation service that protects websites, applications, APIs, and TCP/UDP services against volumetric, protocol, and application-layer attacks.
Built on CDNetworks’ global edge platform, Flood Shield 2.0 detects and filters malicious traffic close to its source, before it can overwhelm origin infrastructure. More than 20 Tbps of mitigation capacity across over 40 scrubbing centers supports resilient protection against large-scale SYN, UDP, ACK, amplification, and multi-vector attacks.
Flood Shield 2.0 also brings DDoS protection, WAF, Bot Management, API Security, and CDN acceleration together on one platform. An AI-powered engine continuously baselines traffic and adapts protection policies as attack patterns change, while legitimate requests continue along optimized delivery paths.
With unified policy management, real-time visibility, attack logs, alerts, and API integration, organizations can protect and accelerate business-critical services without managing separate security and delivery deployments.
DDoS Attack FAQ
What does DDoS stand for?
DDoS stands for Distributed Denial of Service. “Distributed” means the attack traffic comes from multiple devices, systems, networks, or reflected services instead of one source.
Can a DDoS attack steal data?
A DDoS attack is primarily intended to disrupt service availability and does not inherently provide the attacker with access to protected information.
However, an attacker may use a DDoS attack as a diversion while attempting another intrusion. Security teams should investigate associated alerts and unusual activity rather than treating the event only as a performance problem.
How long does a DDoS attack last?
The duration varies. An attack may last for a brief burst, continue for several hours, or return repeatedly as part of a longer campaign.
Attackers may also change traffic volume and attack vectors during the incident.
Can a DDoS attack damage a server?
A DDoS attack usually causes service disruption by exhausting available resources. It does not necessarily cause permanent physical damage.
However, prolonged resource pressure can produce crashes, failed dependencies, corrupted sessions, operational complications, and recovery costs.
Can small businesses be targeted by DDoS attacks?
Yes. Any organization operating a public website, application, API, game, customer portal, or online service can be targeted.
Attackers may select targets based on financial opportunity, ideological motives, business timing, or accessible infrastructure rather than company size alone.
Is a DDoS attack illegal?
Launching a DDoS attack against a system without authorization is generally treated as unlawful computer interference in many jurisdictions.
The exact offense, enforcement process, and penalties depend on the applicable country and circumstances.
Can DDoS attacks be completely prevented?
No organization can guarantee that malicious traffic will never be directed toward its infrastructure.
However, preparation, distributed capacity, continuous monitoring, upstream filtering, application protection, and a tested incident response process can substantially reduce the likelihood that an attack will cause an outage.