A DDoS attack (distributed denial of service) is an attempt to make a website, service or network unavailable by flooding it with traffic from many sources at once.
How DDoS attacks work
The traffic usually comes from a botnet – thousands of infected computers, routers, cameras and servers (zombies) – or from abused third-party services. Attacks fall into three groups:
- volumetric – saturate bandwidth, often via amplification: small spoofed requests to DNS, NTP or memcached servers produce huge responses aimed at the victim;
- protocol – exhaust connection tables of servers, firewalls and load balancers (SYN flood);
- application-layer (layer 7) – imitate real users with floods of HTTP requests to heavy pages or APIs.
Records keep growing: in 2016 the Mirai botnet of IoT devices knocked out the DNS provider Dyn, and in 2023 the HTTP/2 “Rapid Reset” technique produced floods of hundreds of millions of requests per second. Large providers now report attacks of several terabits per second.
Why DDoS matters for security
DDoS attacks cause direct outages and lost revenue, are used for extortion, by hacktivists for political protest and sometimes as a smokescreen for another intrusion. “Booter” or “stresser” services sell attacks for a few dollars, so almost anyone can launch one.
How to defend
- Put public services behind a CDN or DDoS mitigation provider with enough capacity (cloud scrubbing).
- Rate-limit expensive endpoints, cache aggressively and prepare a response plan with your ISP.
- Do not run open DNS, NTP or memcached servers that can be abused for amplification.
- Keep IoT devices updated and change default passwords so they do not join botnets.
