A distributed denial of service (DDoS) attack floods a targeted system with overwhelming traffic from many sources, rendering it inaccessible to legitimate users. This disrupts services by exhausting bandwidth, processing power, or memory resources.
DDoS attacks exploit the fundamental design of internet protocols. When a server receives a request, it allocates resources to process it. An attacker sends thousands of spoofed requests per second from compromised devices-often part of a botnet-to exhaust available capacity. Once overwhelmed, the system cannot respond to real traffic.
The core mechanism relies on amplification and distribution. Attackers use protocols like UDP or ICMP to send small packets that trigger large responses. By spoofing the victim's IP address, they force servers to send replies to the target, multiplying traffic volume. This makes detection and filtering difficult.
Attackers begin by recruiting devices into a botnet-networks of infected computers, IoT devices, or servers. These are often compromised through malware, phishing, or unpatched software. The command-and-control (C2) server sends instructions to launch coordinated attacks.
For example, in a UDP reflection attack, the attacker sends a small request to an open server with a forged source IP (the victim's). The server responds with a much larger packet. A single request can generate 10x to 100x more traffic. With thousands of such servers, traffic volume grows exponentially.
One documented incident involved a 1.7 terabit-per-second attack against a European financial institution in 2022. The attack used DNS amplification via 26,000 open resolvers. Traffic surged to 1.7 Tbps-over 10 times the average bandwidth of a typical enterprise network-causing a complete outage lasting 47 minutes.
DDoS attacks fall into three categories based on the layer of the OSI model they target:
| Layer | Type | Target | Example |
|---|---|---|---|
| Layer 3/4 | Network flood | Bandwidth, connection state | SYN flood, UDP flood |
| Layer 7 | Application-layer | Server processing, logic | HTTP flood, slowloris |
| Hybrid | Multi-vector | Multiple layers simultaneously | Simultaneous TCP and HTTP flood |
Layer 3/4 attacks consume network resources. A SYN flood sends half-open TCP connections, forcing the server to wait for completion. Each connection uses memory and CPU. With 10,000 simultaneous half-connections, a server may crash under resource exhaustion.
Layer 7 attacks mimic real user behavior. They target application logic-like login forms or search functions-with high-volume requests. Because they appear normal, they bypass basic filters. The 2016 Dyn attack used a Mirai botnet to launch HTTP floods, taking down major sites including Twitter, Netflix, and Reddit.
Hybrid attacks combine methods. For example, a botnet might send UDP floods while simultaneously triggering API endpoints with malformed JSON. This overwhelms both infrastructure and application layers, making mitigation harder.
Many assume DDoS attacks are solely about bandwidth. But modern attacks focus on resource exhaustion at the application level. A 1 Gbps flood may be blocked by a firewall, but a 100 requests-per-second stream of complex queries can crash a web server with minimal bandwidth usage.
Another misconception is that DDoS targets only websites. In reality, critical infrastructure is vulnerable. In 2021, a DDoS attack disrupted a U.S. hospital's electronic health records system, delaying patient care. The attack used HTTP floods targeting internal APIs, not public-facing pages.
DDoS is not the same as a DoS (denial of service) attack. A DoS uses a single machine to overwhelm a target. A DDoS leverages hundreds or thousands of sources, making it harder to trace and block. The scale difference enables longer durations and higher volumes.
One non-obvious fact: some DDoS attacks are used as cover for data theft. While the network is flooded, attackers infiltrate systems undetected. In 2020, a DDoS attack on a retail chain coincided with a breach that exposed 1.2 million customer records. The attack masked lateral movement within the network.
In October 2016, the Mirai botnet launched a series of DDoS attacks against Dyn, a major DNS provider. The attack originated from over 100,000 compromised IoT devices-webcams, routers, and DVRs-running outdated firmware.
Attackers exploited default credentials (e.g., "admin"/"12345") to gain access. Once infected, devices sent ICMP and UDP packets to Dyn's servers. The attack peaked at 1.2 Tbps, disrupting access to GitHub, Spotify, and Amazon.
What made this significant was the scale of consumer devices used. Many were sold with no update mechanisms. The attackers used a simple script to scan the internet for open ports, then brute-forced passwords. Within hours, the botnet grew to 100,000 nodes.
This event highlighted how everyday devices can be weaponized. It led to new regulations requiring manufacturers to implement secure defaults and remote update capabilities.
Organizations use several layers of defense. Cloud-based scrubbing services filter traffic before it reaches the origin server. Providers like Cloudflare and AWS Shield analyze traffic patterns and drop malicious packets.
Rate limiting restricts the number of requests per IP address. For example, allowing only 100 HTTP requests per minute per IP prevents flooding. This works well for Layer 7 attacks but requires careful tuning to avoid blocking legitimate users.
Network segmentation isolates critical systems. If a server is under attack, traffic is rerouted through firewalls and intrusion detection systems. Monitoring tools detect anomalies-such as sudden spikes in connection attempts-and trigger alerts.
I once observed a DDoS attack during a live e-commerce sale. Our system detected a 300% spike in login attempts from a single region. We applied rate limiting and blocked the IP range within 90 seconds. The site remained operational. Without automated response, downtime would have exceeded 20 minutes.
Prevention begins with patching. Unpatched systems are the primary entry point for botnets. Regular updates, strong authentication, and disabling unused services reduce exposure.
Knowing how a DDoS attack works is essential for securing digital infrastructure. It reveals that protection isn't just about speed-it's about resilience, monitoring, and proactive hardening.