DDoS Attack
A distributed denial-of-service attack that floods a target with massive traffic from multiple sources to overwhelm and disrupt services.
A distributed denial-of-service (DDoS) attack attempts to make an online service, website, or network resource unavailable by overwhelming it with a flood of traffic from many distributed sources. Unlike a simple denial-of-service (DoS) attack from a single source, DDoS attacks leverage networks of compromised devices — botnets that can include hundreds of thousands of infected computers, IoT devices, and servers — to generate traffic volumes that no single server or network can absorb.
DDoS attacks operate at different layers of the network stack. Volumetric attacks (Layer 3/4) flood the target's bandwidth with massive amounts of UDP, ICMP, or TCP SYN packets. Protocol attacks exploit weaknesses in network protocol behavior — SYN floods, for example, exhaust server connection tables. Application-layer attacks (Layer 7) target specific web application resources with legitimate-seeming requests that are computationally expensive to process, such as complex database queries or large file requests. Modern attackers often combine multiple attack vectors simultaneously, making mitigation more challenging.
The DDoS threat landscape has grown dramatically. Attack sizes regularly exceed terabits per second, amplification techniques allow attackers to multiply their bandwidth by factors of 50,000 or more, and DDoS-for-hire services make launching attacks trivially easy and inexpensive. The impact ranges from temporary service disruption to extended outages costing millions in revenue and recovery. Some DDoS attacks serve as smokescreens for simultaneous data breaches. Effective defense requires upstream DDoS mitigation services, redundant infrastructure, traffic analysis and rate limiting, incident response planning, and geographic distribution of resources.
DDoS attacks operate at different layers of the network stack. Volumetric attacks (Layer 3/4) flood the target's bandwidth with massive amounts of UDP, ICMP, or TCP SYN packets. Protocol attacks exploit weaknesses in network protocol behavior — SYN floods, for example, exhaust server connection tables. Application-layer attacks (Layer 7) target specific web application resources with legitimate-seeming requests that are computationally expensive to process, such as complex database queries or large file requests. Modern attackers often combine multiple attack vectors simultaneously, making mitigation more challenging.
The DDoS threat landscape has grown dramatically. Attack sizes regularly exceed terabits per second, amplification techniques allow attackers to multiply their bandwidth by factors of 50,000 or more, and DDoS-for-hire services make launching attacks trivially easy and inexpensive. The impact ranges from temporary service disruption to extended outages costing millions in revenue and recovery. Some DDoS attacks serve as smokescreens for simultaneous data breaches. Effective defense requires upstream DDoS mitigation services, redundant infrastructure, traffic analysis and rate limiting, incident response planning, and geographic distribution of resources.
Examples
- A botnet of compromised IoT devices floods an e-commerce site with traffic during a major sales event, causing hours of downtime.
- A DNS amplification attack generates 1 Tbps of traffic directed at a financial services company, overwhelming its network.
- An application-layer DDoS targets a login endpoint with millions of requests, exhausting the web server's processing capacity.
Prevention
- Use a DDoS mitigation service or CDN with built-in DDoS protection to absorb and filter attack traffic.
- Implement rate limiting and traffic shaping to manage request volumes during potential attacks.
- Design infrastructure with redundancy and geographic distribution to withstand traffic surges.
- Develop and regularly test a DDoS incident response plan with clear escalation procedures.