A Distributed Denial of Service attack is an attempt to make an online service unavailable by overwhelming it with traffic from many sources at once. The keyword is distributed: instead of one machine sending requests, the attacker controls thousands of compromised devices that all target the same victim simultaneously.
Those compromised devices form a botnet. Home routers, security cameras, and infected computers around the world receive a command and begin sending traffic. Because the flood arrives from thousands of legitimate-looking IP addresses, the victim cannot stop it by blocking a single source.
The motivation varies. Extortion, competition between game communities, hacktivism, and simple vandalism all drive the DDoS-for-hire market, where booter services rent botnet capacity for a few dollars per attack.
The Three Families of DDoS Attacks
Every DDoS attack targets one of three resources: bandwidth, connection state, or application processing. Defenses differ for each family.
| Family | Examples | Target resource | Typical measurement |
|---|---|---|---|
| Volumetric | UDP flood, DNS and NTP amplification | Network bandwidth | Gigabits per second |
| Protocol | SYN flood, ACK flood, fragmented packet attacks | Connection state tables | Packets per second |
| Application layer | HTTP flood, Slowloris, HTTP/2 Rapid Reset | Web server workers and CPU | Requests per second |
Amplification attacks deserve special attention. The attacker sends small queries to open DNS or NTP servers with the victim’s spoofed IP address. The servers answer with responses up to fifty times larger, all directed at the victim. A modest botnet can generate terabits of traffic this way.
Incidents That Shaped the Industry
The record for the largest attack keeps falling. Each milestone forced the defense industry to rebuild its assumptions.
- Krebs on Security, 2016The Mirai botnet hit the security blog with roughly 620 Gbps, then attacked the DNS provider Dyn weeks later, knocking major sites offline across the US east coast.
- GitHub, 2018A memcached amplification attack peaked at 1.35 Tbps. GitHub mitigated it in minutes by shifting traffic to a scrubbing service.
- AWS, 2020Amazon reported absorbing a 2.3 Tbps CLDAP reflection attack against a customer, at the time the largest ever disclosed.
- Google, 2017, disclosed 2020Google revealed it had absorbed a 2.54 Tbps attack three years earlier, showing how long the largest events can stay private.
- Microsoft Azure, 2021Azure reported mitigating a 3.47 Tbps attack against an Asian customer, the largest volumetric event it had published.
- Cloudflare, 2023The HTTP/2 Rapid Reset campaign peaked at 398 million requests per second, proving application-layer attacks can rival volumetric records in impact.
Defense in Depth
No single product stops every attack family. Resilient organizations layer several defenses and test them regularly.
- Anycast distribution spreads traffic across a global network so no single location absorbs the full flood.
- Upstream scrubbing centers filter attack traffic before it reaches your connection.
- Rate limiting and connection caps protect state tables from protocol attacks.
- A web application firewall filters malicious HTTP patterns at the application layer.
- An incident runbook defines who acts, what gets rerouted, and how communication flows during an attack.
The last layer is validation. Authorized stress testing with an IP stresser confirms that each defense engages at the threshold you expect, before a real attacker tests it for you.