What is a DDoS attack?

The Internet Engineering Task Force describes the problem in RFC 4732, and a joint guide from CISA, the FBI and MS-ISAC, Understanding and Responding to DDoS Attacks, covers how organisations prepare and respond.

Denial of service is the outcome: a service that should answer does not. Distributed describes how it is achieved: instead of one machine sending everything, thousands of machines each send a share, so no single source looks large and blocking one address changes nothing. Spreading the target side as well, across many addresses at once, is called carpet bombing.

The sources are usually devices their owners do not know are involved: routers, cameras and servers infected with malware and controlled together as a botnet; Mirai is the best-known botnet built from such devices. Some attacks also borrow innocent servers on the internet as reflectors, which answer a small forged request with a much larger reply aimed at the victim.

In everyday use the word is also a verb. Saying a site was ddosed, or that somebody is ddosing it, means its service was overwhelmed by traffic, not that it was hacked.

Every service has a limit somewhere: the bandwidth of the link in front of it, the number of connections a device can track, or the work a server can do per second. A DDoS attack is aimed at one of those limits.

1. Gather capacity. The attacker controls or rents a botnet, or finds reflectors that will amplify traffic.
2. Choose a limit to exhaust. A link, a connection table, or an expensive page or API call.
3. Send traffic at the target. From many sources at once, often shifting between techniques when one is blocked.
4. Hold the pressure. Attacks last from minutes to days; the service is degraded or offline for as long as the traffic exceeds its limit.

Which limit is targeted decides which defence helps, and that is the reason attacks are grouped by layer on attack layers.

A DoS attack, plain denial of service, comes from one source or a few. A DDoS attack comes from many. The goal is identical; the difference is in how hard it is to stop.

Traffic from one source can be refused by refusing that source. Traffic from thousands of sources cannot, because each source sends little and blocking them one by one is slower than the attack. That is why the distributed form dominates, and why defences rely on capacity and on judging behaviour rather than on lists of addresses.

Some denial of service needs no flood at all. A single request that triggers a crash, or a slow connection that holds a server resource open, can deny service from one machine; the low-and-slow techniques are examples.

• Volumetric attacks. Fill the link with traffic, often amplified through reflectors; volumetric attacks covers UDP and ICMP floods and amplification.
• Protocol attacks. Exhaust the state that devices keep for connections; protocol attacks covers SYN and ACK floods.
• Application-layer attacks. Send requests that are valid but expensive, so the server runs out of capacity; application-layer attacks covers HTTP floods, Slowloris and API abuse.

The full map, with every vector on its own page, is on DDoS attack types.

Most attacks look first like an ordinary outage, which is why the cause is often found late.

• A sudden rise in traffic or connections that does not match a launch, a campaign or the time of day.
• Slowness or errors across a whole service, not one feature, while the code and the hosts look healthy.
• Traffic concentrated in an unusual way: one URL, one country, one network range, or one type of packet.
• Your provider reports saturation on the link in front of you, sometimes before you notice anything.

None of these proves an attack on its own. A popular post or a misbehaving integration produces the same graphs, and the first step is to rule out your own changes.

Motives range from extortion, where the attacker demands payment to stop (see ransom DDoS), to protest, competition, revenge, and the distraction of a security team while something else happens.

Attacks are cheap to start because capacity can be rented. That changes who is a target: a small site can be attacked by someone with a grudge and a little money, not only large companies by organised groups.

When the traffic stops, the service usually returns on its own; nothing was installed that has to be removed. What remains is the work of understanding it: which limit was reached first, how long detection took, who was called and how quickly the provider acted.

That review is what makes the next attack shorter. Keep the timeline, the graphs and the logs, write down which changes were made during the attack, and reverse the emergency ones deliberately. Attackers often return to a target that went down once, so the gaps found the first time are the ones to close first.

Report the attack if it came with a demand or caused real harm. Law enforcement and national cyber agencies collect these reports, and in some sectors a report is required.

Protection is layered because the attacks are. Network capacity and filtering in front of you absorb floods that fill links. Devices and services that track connections are hardened against state exhaustion. A request filter and rate limits handle application-layer attacks, which arrive as valid requests.

No single component covers all three, and a web application firewall covers only the last. The guide from CISA and its partners puts preparation first: know your critical services, know who carries your traffic, and agree with them in advance what happens when an attack starts.