What is Distributed Denial of Service (DDoS)?

What is a distributed denial of service (DDoS) attack?

A distributed denial of service (DDoS) attack is an attempt to make a website, server or network unavailable by flooding it with traffic from many machines at once. CISA describes the sources as usually a botnet, a group of hijacked internet-connected devices whose owners often do not know they are infected. Because the traffic comes from many places, blocking one address does not stop it, and the attack is harder to trace than a plain denial of service (DoS) attack from a single source.

How a DDoS attack works

The attacker controls a botnet and tells every device to send requests to the same target. The target runs out of bandwidth, connection slots or processing capacity, slows down, and legitimate users get errors or timeouts. Botnets can also be rented, so launching an attack does not require technical skill, which is one reason these attacks stay common.

Main types of DDoS attack

Attacks are usually grouped by the layer they overload. Each type has its own entry:

• Volumetric floods fill the network link itself. Examples: UDP flood, DNS amplification and Memcached reflection, where a small spoofed request makes a server send a much larger reply to the victim.
• Protocol attacks exhaust connection state in servers and network devices, for example a SYN flood that leaves connection requests unfinished.
• Application-layer attacks look like normal requests but target expensive work: application-layer DDoS in general and the HTTP flood in particular.
• DNS-targeted attacks aim at name resolution so users cannot find your site at all: see DNS DDoS.
• Extortion pairs an attack, or a threat of one, with a payment demand: see ransom DDoS.

Signs of an attack

CISA lists unusually slow network performance, a particular website being unavailable, or no websites being reachable. These symptoms can also come from maintenance or ordinary faults, so traffic monitoring is the way to confirm an attack: look for a sudden jump in requests, concentrated on one URL or coming from a narrow set of networks, without a matching business reason such as a campaign.

Defence

CISA recommends a DoS protection service that filters malicious traffic, a disaster recovery plan covering communication, mitigation and recovery, a firewall restricting traffic, sound security settings, and monitoring with alerts for abnormal load. The practical steps are in how to stop DDoS attacks, DoS protection and the overview of DDoS attacks.

Where load testing and monitoring fit

Load testing is not a DDoS defence, and LoadFocus does not simulate DDoS attacks. What it gives you is your normal-traffic capacity limit: where response times climb and errors start, which tells you how much headroom you have before any surge, hostile or not. Run a cloud load test to find it, and see spike testing for sudden-surge scenarios. Only test systems you own or have explicit permission to test. Never aim traffic at someone else's service.

FAQ: DDoS attacks

What is the difference between DoS and DDoS?

A DoS attack comes from one source. A DDoS attack comes from many sources at once, usually a botnet, so it is bigger and blocking one address does not stop it.

Why do attackers use a botnet?

A botnet multiplies the volume of traffic and hides the real source, because requests arrive from thousands of ordinary-looking devices.

Can a DDoS attack steal my data?

The goal of a DDoS attack is to make a service unavailable, not to take data. It can, however, be used as a distraction while something else happens, so review your logs during an incident.

Is it legal to test my site against a DDoS attack?

Do not launch attack traffic yourself. Use a mitigation provider that offers authorised, controlled exercises, and use ordinary load testing, with permission, to learn your capacity.