What Is a DDoS Attack

A DDoS (Distributed Denial of Service) attack sends large volumes of traffic from many computers to a target server or network and leaves the service unusable. Unlike a DoS attack launched from a single source, it is distributed across a botnet of thousands to millions of devices (machines infected with malware), so blocking source IP addresses alone is not enough to defend against it.

Attack volumes reaching the Tbps range were confirmed at an early stage. CISA alert TA16-288A in the United States (published October 2016, revised October 2017) describes how the security news site krebsonsecurity.com was hit by an attack exceeding 620 Gbps in September 2016, and that a separate attack in the same period may have reached around 1.5 Tbps. Both came from botnets of IoT devices infected with malware called Mirai, and according to the same alert Mirai spread to home routers, network cameras, and DVRs by trying 62 sets of commonly used default credentials.

That said, the figure for the largest volume ever observed keeps being updated by reports from mitigation providers, so chasing it has no end. What matters in practice is how many times your own line capacity and processing capability you can absorb, and deciding in advance who takes over once that ceiling is exceeded, your own team or a mitigation provider.

Attack Classification and Techniques

DDoS attacks fall into three broad categories depending on which layer of the OSI reference model they target.

Volumetric Attacks (L3/L4)

Attacks that aim to saturate line bandwidth. UDP floods, ICMP floods, and DNS amplification (amplifying DNS responses and directing them at the target) are typical methods. In DNS amplification, the attacker sends many small queries to numerous open resolvers with the source IP address spoofed as the target, and the amplified responses converge on the target. The list of bandwidth amplification factors published by CISA in the United States (Alert TA14-017A, revised December 2019) gives 28 to 54 times for DNS, 556.9 times for NTP, and 10,000 to 51,000 times for memcached. The higher the amplification factor of a protocol, the more bandwidth an attacker can generate from fewer sources.

Protocol Attacks (L3/L4)

Attacks that exhaust the resources of servers and network equipment. The typical method is the SYN flood (abusing the TCP three-way handshake to consume resources with half-open connections). By overflowing the connection tables of a firewall or load balancer, legitimate traffic can no longer be processed either.

Application Layer Attacks (L7)

Attacks that abuse application layer protocols such as HTTP requests. Methods include Slowloris (deliberately delaying HTTP connections to exhaust the server's connection slots) and sending large numbers of search queries that put a heavy load on the database. They consume server resources efficiently even with little traffic volume, so countermeasures against volumetric attacks alone are not enough.

Defense Strategies and Architecture

Defense against DDoS attacks is fundamentally defense in depth, layering countermeasures at several levels.

Making use of a CDN: distributing content to edge servers around the world absorbs attack traffic. Whether the provider's distributed infrastructure can take volumes that your own line could never handle is the key point when choosing one
Deploying a WAF: detects and blocks application layer attack patterns. Rules such as rate limiting, IP reputation, and bot detection are combined
Auto scaling: in cloud environments, servers scale out automatically as attack traffic increases, keeping the service available
Anycast routing: advertising the same IP address from multiple locations spreads attack traffic geographically
Rate limiting and traffic shaping: limits the number of requests from a single IP address and detects and blocks abnormal traffic patterns

On AWS, a combination of CloudFront, AWS Shield, and WAF is often adopted. Shield Standard automatically mitigates typical L3/L4 attacks at no additional cost. Shield Advanced is a paid subscription that adds protection for target resources such as CloudFront, ELB, Global Accelerator, Route 53, and EC2. However, even with a Shield Advanced subscription, contacting the Shield Response Team requires Business or Enterprise level AWS Support separately (terms of provision as of August 2026). Unless the budget also covers the arrangement by which someone comes to help when an incident happens, the support you believed you had contracted for will not arrive.

Incident Response

Responding quickly when a DDoS attack arrives is directly tied to keeping the damage to a minimum. It is important to include a DDoS scenario in the incident response plan.

Detection and first response: monitoring alerts detect abnormal increases in traffic, degraded response times, and rising error rates. Identify the type of attack (volumetric / protocol / L7)
Applying mitigation: enable the DDoS mitigation service of the CDN or cloud provider. Add WAF rules matched to the attack pattern. Request upstream filtering from the ISP if necessary
Communication and records: report the situation to stakeholders and post a notice for users. Preserve logs of the attack (source IP addresses, traffic volumes, attack patterns)
Post-incident analysis: analyze the whole picture of the attack and identify improvements to the defenses. Review the resilience of the entire infrastructure, including whether static content can be moved to object storage and the CDN side, together with cloud storage security settings

DDoS attacks are sometimes used as a diversion for another attack. Because there is a tactic of attempting intrusion through a different route while the team is busy handling the DDoS, it is important not to relax the rest of the security monitoring while a DDoS is under way.

Common Misconceptions

Small sites are not targeted by DDoS attacks: DDoS attacks are carried out for many reasons, including extortion for money, disruption of a competitor, and political motives. Ordering an attack from a service that calls itself a booter or stresser is also a known pattern, and an attack can be launched regardless of the size of the target. From the defender's point of view, not being able to think of a reason to be targeted is no basis for safety.
Increasing bandwidth prevents DDoS attacks: Bandwidth increases provide some defense against volumetric attacks, but application-layer attacks exhaust server resources with minimal traffic. Multi-layered measures including WAF and rate limiting are necessary.

DDoS Attack Types Comparison

Volumetric Attack

Aims to saturate bandwidth. Very high traffic volume (hundreds of Gbps to Tbps). CDN and ISP-level absorption is effective. DNS amplification is a typical example.

Application Layer Attack

Aims to exhaust server processing capacity. Effective even with low traffic volume. Requires WAF and rate limiting for defense. Slowloris and HTTP floods are typical examples.

DDoS Attack