What is the practical difference between volumetric and application-layer DDoS attacks?

The practical difference is that volumetric attacks aim to overwhelm your server's bandwidth capacity, while application-layer attacks target specific software services to exhaust their resources.

Volumetric attacks, like DNS amplification or UDP floods, generate massive traffic volumes measured in Gbps, aiming to saturate your internet pipe. They are brute-force but often easier to detect and mitigate upstream. Application-layer attacks, like HTTP floods or slowloris, send seemingly legitimate requests to exhaust Apache/nginx worker connections or database resources. They are stealthier, harder to distinguish from real traffic, and typically require deeper inspection.

For an e-commerce site, application-layer attacks are often more dangerous as they can cripple your site with far less traffic, directly impacting availability and revenue. While volumetric attacks are common, their mitigation usually happens at your hosting provider or ISP level. Ensure your protection plan includes behavioral analysis or rate limiting for Layer 7.

You can monitor application-layer resource usage with commands like:

netstat -tn | awk '{print $6}' | sort | uniq -c # Check connection states

pgrep -lfa php-fpm | wc -l  # Count PHP-FPM processes