DDoS

DDoS, or Distributed Denial of Service, is a distributed denial-of-service attack. Its goal is to overload a website, server, application, network or another digital service with a large number of requests so that it becomes unavailable to regular users.

Unlike a regular DoS attack, where traffic comes from a single source, a DDoS attack is carried out from many devices at once. These may include infected computers, servers, routers, IoT devices or other nodes combined into a botnet. Due to its distributed nature, such an attack is harder to block: malicious traffic comes from different IP addresses, countries and networks.

DDoS attacks are dangerous for businesses because they directly affect service availability. If a website, user account area, online store, API or corporate portal stops responding, the company loses leads, orders, customer trust and may face financial losses.

How a DDoS Attack Works

During a DDoS attack, an attacker directs a large stream of requests or network traffic at the target. The system tries to process these requests, but resources become insufficient: the communication channel, server, load balancer, firewall or the application itself becomes overloaded.

The attack can target different levels of infrastructure. Sometimes the goal is to saturate the network channel with high-volume traffic. In other cases, attackers send a large number of requests to an application, such as a login page, search function, shopping cart or API. Such attacks may look similar to real user behavior, which makes them harder to distinguish from normal load.

DDoS is often used not only as a standalone threat, but also as a distraction. While the IT team is dealing with service unavailability, attackers may try to perform other actions: brute-force passwords, search for vulnerabilities or attack neighboring systems.

Main Types of DDoS Attacks

DDoS attacks differ in mechanics and target. Some overload the network, while others affect server resources or the application layer. For protection, it is important to understand exactly what type of traffic is causing the problem.

The main types of DDoS attacks include:

• volumetric attacks, which overload the internet channel with a large amount of traffic;
• protocol attacks, which target network equipment, load balancers and firewalls;
• application-layer attacks, which imitate requests to a website, API or application;
• amplification attacks, where the attacker uses third-party servers to amplify traffic;
• multi-layer attacks, which combine several methods at the same time.

For example, during an application-layer attack, a website may receive thousands of requests to a resource-intensive page. The network channel may not be fully saturated, but the application stops responding because of the load on the database or backend.

How to Tell If a DDoS Attack Is Happening

Signs of a DDoS attack depend on its type. Sometimes a service becomes completely unavailable. In other cases, users notice slow page loading, authorization errors, connection drops or unstable operation of certain functions.

A DDoS attack may be indicated by a sharp increase in incoming traffic, a large number of identical requests, unusual request geography, increased load on the processor, memory, database or network equipment. The number of 5xx errors, timeouts and connection failures also often increases.

It is important to distinguish an attack from a normal traffic spike. For example, increased traffic after an advertising campaign or media publication may look similar. That is why monitoring, logs, WAF, DDoS protection systems, network analytics and provider data are used for analysis.

DDoS Protection

DDoS protection should be prepared in advance. When an attack has already started, there is usually little time to configure the infrastructure. A basic approach includes traffic monitoring, resource redundancy, filtering of suspicious requests and the use of specialized protection services.

For websites and applications, CDN, WAF, rate limiting, load balancing, geographic filtering and protection on the hosting provider or data center side are often used. For network infrastructure, sufficient channel bandwidth, provider-level filtering, routing configuration and the ability to quickly redirect traffic through a scrubbing center are important.

A company should also prepare an incident response plan in advance: who makes decisions, which systems are checked first, what provider contacts are available, how customers are informed and how the consequences of the incident are recorded.

FAQ

🠔 Back to glossary