What is DDoS?

A Distributed Denial of Service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic from multiple sources. Unlike a simple Denial of Service (DoS) attack which comes from a single source, a DDoS attack leverages a network of compromised devices, called a botnet, to generate the attack volume. These devices can include home routers, IoT cameras, servers, and personal computers, often infected with malware without the owner's knowledge.

The attack works by directing all the bots in the botnet to send requests simultaneously to the target. This flood of data packets, connection requests, or malformed messages consumes the target's bandwidth, CPU cycles, or memory, preventing it from responding to legitimate requests. Common types include volumetric attacks (e.g., UDP floods, ICMP floods) which saturate bandwidth, protocol attacks (e.g., SYN floods) which exploit server resources, and application layer attacks (e.g., HTTP floods) which target specific web application functions like search or login.

DDoS attacks are a persistent threat on the internet, with mitigation typically handled by specialized cloud scrubbing services or on-premises hardware. Attack sizes are measured in gigabits per second (Gbps) or packets per second (pps). The largest recorded attacks exceed 1 Tbps. Defenses include rate limiting, traffic filtering, anycast routing, and behavioral analysis to distinguish attack traffic from legitimate users. DDoS attacks are illegal in most jurisdictions and are often launched for extortion, hacktivism, or competitive disruption.