What Is Denial-of-Service (DoS) Protection?

What is Denial-of-Service (DoS) protection?

DoS protection is the set of controls that keep a service reachable while someone tries to exhaust its bandwidth, connections or compute. It combines filtering at the network edge, rate limits, caching, hardened server settings and a response plan. The aim is not to stop the attempt, which you cannot, but to keep legitimate users served while it happens.

How a DoS attack works

A denial-of-service attack floods a target with traffic or requests so that legitimate users cannot get in. CISA describes it as a condition in which legitimate users are unable to access information systems, devices or other network resources. With one source it is a DoS attack; when many machines, often a botnet of hijacked devices, attack together it is a distributed denial-of-service (DDoS) attack. The distributed form is stronger and harder to trace back to its source.

The three places an attack lands

• Bandwidth. Volumetric floods, such as a UDP flood, fill the network link so nothing else gets through.
• Connection state. A SYN flood opens half-finished TCP connections until the server has no room for real ones. RFC 4987 lists the countermeasures, including SYN cookies, and what each one costs.
• Application work. Requests that look normal but are expensive, like search or login calls, can exhaust CPU or the database with little bandwidth. See application-layer DDoS attacks.

How DoS protection is layered

• Edge network or scrubbing service. A CDN or DoS-protection service spots abnormal traffic and filters it before it reaches your origin. This is CISA's first recommendation.
• Firewall and rate limits. Drop traffic you never expect and cap requests per client, with stricter limits on expensive endpoints. Set the numbers from measured usage, because many users can share one IP address.
• Caching. Every response served from the edge is work the origin never does.
• Smaller attack surface. Keep the origin address private, close unused ports and keep systems patched.
• Spare capacity and alerts. Autoscaling buys time, but it also scales your bill, so pair it with alerts and spending caps.
• A response plan. Decide who confirms an attack, who calls your provider or ISP, and who updates customers. CISA also warns that an attack can be a distraction while something else happens on your network.

For the full playbook, read how to stop DDoS attacks.

Example: a login endpoint under pressure

A SaaS login page starts timing out. Bandwidth is normal, but the database is at full load and the logs show thousands of login attempts per minute from many addresses. The fix is layered: a rate limit on the login path, a challenge for clients that exceed it, cached static pages so they cost almost nothing, and an alert on request rate per path so the next burst is caught in minutes rather than after customers complain.

Common mistakes

• Protecting only the origin. One server or one link can be saturated, so the edge has to come first.
• No traffic baseline. Without normal request rates you cannot tell an attack from a sale or a viral post. RFC 4732 notes that flash crowds can look the same as attacks.
• Limits that block real users. Aggressive blocks or blocklists can cause the outage themselves.
• Arranging help mid-attack. Onboarding a provider during an incident is slow. Have contracts, DNS access and contacts ready.
• Treating it as a network-only problem. Requests that look like normal users pass straight through network-level filters.

DoS protection, load testing and monitoring

LoadFocus is not a DoS-protection or security product, and it does not simulate attacks. What it can do is show how much legitimate traffic your own system handles before it slows down or fails. Load tests send HTTP requests to your own site or API from cloud regions, so you can see where latency climbs, whether your rate limits answer with 429 as designed and whether autoscaling reacts in time. Start with load testing vs stress testing and API rate limiting causes.

Only test systems you own or have written permission to test, and tell your CDN or cloud provider before any high-volume run. Afterwards, API monitoring with alerts on errors and response time is often the first outside signal that something is wrong; free checks run every 5 minutes.

FAQ: DoS protection

What is the difference between DoS and DDoS protection?

The defences overlap. A single-source DoS can often be stopped with a firewall rule or rate limit, while a DDoS comes from thousands of sources and needs an edge network or scrubbing service with more capacity than the attack.

Can I fully prevent DoS attacks?

No. CISA notes that there is no way to completely avoid becoming a target. You reduce the impact and recover faster.

How do I know I am under a DoS attack?

Typical signs are a slow or unreachable site, a jump in requests or errors, and traffic from unusual sources. These can also come from a technical fault or a legitimate surge, so check traffic logs and ask your network team or ISP.

Does a CDN protect against DoS attacks?

It absorbs much volumetric and cached-content traffic at the edge. Application-layer floods also need firewall rules and rate limits tuned to your traffic.

Can load testing replace DoS protection?

No. Load testing shows how your own system behaves under heavy legitimate traffic. It does not stop attacks, and it is not a substitute for edge protection.