What Is a DDoS Attack? How Distributed Denial of Service Works and How to Defend Against It
✦ Key takeaways
- A DDoS uses thousands of infected devices (a botnet) to flood a target with requests at once.
- Three families: volumetric attacks, protocol attacks, and application-layer attacks.
- Attack size is measured in gigabits per second (Gbps) or requests per second (RPS).
- The most practical defense is a CDN plus a dedicated DDoS-mitigation service set up before an attack.
Imagine thousands of people suddenly crowding the narrow doorway of your shop at the same moment — not to buy anything, but to block real customers from getting in. That is exactly what a DDoS (Distributed Denial of Service) attack does: it floods a server, website, or network with a huge volume of fake requests until its resources are exhausted and it can no longer serve legitimate visitors.
The key word is distributed. In an ordinary denial-of-service (DoS) attack, the pressure comes from a single machine and is easy to block. In a DDoS, requests arrive from thousands or even millions of devices scattered around the world — computers, cameras, and Internet-of-Things gadgets infected with malware and turned into an army called a botnet, controlled remotely by the attacker without their owners' knowledge.
Invoice & Quotation Maker
Professional invoices that auto-calc & print/PDF in a minute.
The three main types
Not all DDoS attacks are alike. Experts sort them into three families based on the network layer they target, and each requires a different mitigation approach:
| Type | What it targets | Example | Measured in |
|---|---|---|---|
| Volumetric | Bandwidth | DNS/NTP amplification | Gigabits per second (Gbps) |
| Protocol | Server & firewall resources | SYN flood | Packets per second (pps) |
| Application-layer | The app itself (Layer 7) | HTTP flood on a login page | Requests per second (RPS) |
Volumetric attacks are the most famous: the attacker fills the entire connection pipe with meaningless data, often using an amplification trick — sending a small request to an open server with the victim's address spoofed, so the server replies to the victim with a response tens of times larger. Application-layer attacks are the most dangerous and hardest to spot, because they mimic real user behavior and target expensive operations like search or login, exhausting the server with far fewer requests.
How attack size is measured
Volumetric attacks are measured in gigabits per second (Gbps) or even terabits (Tbps), while application attacks are measured in requests per second (RPS). For scale: documented attacks have broken the 3.8 Tbps barrier in recent years — enough to knock over entire infrastructure if it were unprotected. But more importantly, even a "small" attack of a few Gbps can be enough to take down a modest site running on a single server.
How to defend your site in practice
Defending against DDoS does not start during the attack — it starts before it. The most practical steps: put your site behind a CDN (Content Delivery Network) that absorbs and spreads requests across hundreds of servers, hiding your origin server's real address. Enable a dedicated DDoS-mitigation service (offered by major hosting and security providers) that detects abnormal patterns and filters them automatically. Add rate limiting and a "are you human?" challenge on sensitive pages, and keep a response plan and your host's contact numbers ready.
The good news is that most protection tools are now within reach of small sites, many with free tiers that are enough to start. The less pleasant news is that attacks grow larger and smarter every year, so advance preparation — not late reaction — is what separates a few minutes of downtime from a multi-day disaster.