What Is a DDoS Attack?
A DDoS (Distributed Denial of Service) attack overwhelms a target with traffic from many sources at once, aiming to exhaust its capacity so real users cannot get through. It attacks the availability leg of the CIA triad directly. Because the flood comes from thousands of distributed machines — often a botnet — simply blocking one address does nothing.
What are the main types?#
DDoS attacks target different resources, and the type dictates the defense:
| Type | Targets | Measured in | Example |
|---|---|---|---|
| Volumetric | Bandwidth | Gbps | UDP/amplification floods |
| Protocol | Connection state | packets/sec | SYN flood |
| Application (L7) | App resources | requests/sec | HTTP request floods |
Volumetric attacks try to fill the pipe; protocol attacks exhaust the state tables of servers and firewalls; application-layer attacks send requests that look legitimate but are individually expensive, so they need far less traffic to hurt.
Why are DDoS attacks hard to stop?#
Because the traffic is distributed and often mimics legitimate users. Blocking by source fails when there are thousands of sources; blocking by pattern risks dropping real users. The most damaging application-layer attacks can be low-volume yet crippling, sailing past simple bandwidth defenses.
DDoS is the headline availability attack. See how it is countered in DDoS mitigation and more at the Network Security hub.
Frequently asked questions#
What is a DDoS attack?
A Distributed Denial of Service (DDoS) attack floods a target — a server, network, or application — with traffic from many sources at once, exhausting its capacity so legitimate users cannot reach it. Because the traffic comes from thousands of distributed systems, often a botnet, it is far harder to block than a single-source attack.
What are the main types of DDoS attacks?
Volumetric attacks flood bandwidth with sheer traffic volume (measured in Gbps). Protocol attacks exhaust server or firewall state, like SYN floods. Application-layer attacks send seemingly legitimate requests that are expensive to process (measured in requests per second). Each targets a different resource and needs a different defense.