The largest DDoS attacks, and what each one changed

What a DDoS attack is, and how one works, is on what is a DDoS attack.

Figures are as each operator reported them at the time. Different companies measure differently and see different parts of the internet, so records from different sources are not strictly comparable.

On 28 February 2018, GitHub was hit by a flood that peaked at 1.35 Tbps. The attackers sent small requests to memcached servers left open on the internet, with GitHub's address as the source, and the servers replied with much larger answers. GitHub's incident report describes moving traffic to a scrubbing provider and recovering within minutes.

The technique, rather than the botnet, made it possible: one exposed service type multiplied the attacker's traffic. See memcached DDoS and amplification attacks.

Application-layer records are counted in requests, because each request costs the server real work. In June 2022 a Google Cloud customer received an HTTPS flood peaking at 46 million requests per second.

A year later, attacks using HTTP/2 Rapid Reset reached 398 million requests per second. The technique opened and immediately cancelled streams on a single connection, so each connection produced far more work than before. It was a protocol weakness, tracked as CVE-2023-44487, and was fixed by changes in servers and proxies rather than by more capacity alone.

• A new technique each time. Insecure devices, open amplifiers, a protocol feature; volume followed the technique.
• The target survived when capacity was in front of it. Each report describes absorbing or diverting the attack upstream of the servers.
• Layer matters. Bandwidth records and request records are different problems with different defences; see layer 3, 4 and 7 attacks.
• Most attacks are far smaller. A site does not need record-scale traffic to go down; a flood just larger than its own link is enough.

Several security companies publish live DDoS maps that animate attacks between countries. They show what that company's sensors or customers see, usually sampled and delayed, drawn to look dramatic.

They are useful for a sense of scale and of which countries host the most attack traffic, not for deciding whether you are under attack. For that, look at your own traffic; see DDoS detection.