What Is a DDoS Attack: A DDoS attack (distributed denial of service attack) floods a website, server, or network with traffic from many hijacked devices, so real users can't get in. It usually runs through a botnet. The best defense is always on DDoS protection that filters bad traffic before it reaches you.
Key takeaways:
A DDoS attack comes from many sources at once. A DoS attack comes from one.
There are three main types: volumetric, protocol, and application layer.
Most attacks are short and small, but a few now top 1 Tbps.
You need automatic DDoS mitigation, because manual response is too slow.
What Is a DDoS Attack?
Picture a tiny coffee shop with one door. Now imagine 10,000 people cramming in just to stand there. Your real customers can't reach the counter. That's a DDoS attack, and I see people underestimate it all the time.
I'll show you how it works, how big it's gotten, and exactly how to protect yourself. Stick with me.
The NIST glossary defines it as a denial of service technique that uses numerous hosts to perform the attack. Simple enough, right?
DoS vs DDoS: What's the Difference?
A DoS attack comes from one machine. A DDoS comes from thousands. That's the whole gap, but it matters a lot.
Blocking one IP address stops a DoS. Against a DDoS, you'd be blocking forever. CISA's joint guide notes these attacks are hard to trace because they come from many sources.
How Does a DDoS Attack Work?
Attackers don't use their own computers. They borrow yours, your neighbor's, and that cheap webcam in the hallway. Then they aim everything at one target.
Here's the process, step by step, so you can see how little skill it takes.
Step 1: Build a Botnet
Hackers infect devices with malware. Routers, DVRs, laptops, and baby monitors all work. These hijacked machines form a botnet, and the owners rarely notice.
Your own gear can be part of one. If you're unsure how your home network fits together, start with what a router does. And if you suspect an infected phone, here's how to remove malware from Android.
Step 2: Send the Command
A command and control server tells every bot to fire at once. Thousands of requests land in the same second.
Step 3: Overwhelm the Target
The target's bandwidth, CPU, or connection table fills up. Real visitors see errors. You get downtime, lost revenue, and a bruised reputation.
What Are the Types of DDoS Attacks?
Floods aren't all the same. CISA, the FBI, and MS-ISAC group them into three technique types. Your defense should match the type you're facing.
Here's the quick comparison, followed by details on each one.
Type | Layer | What it targets | Example | Typical defense |
|---|---|---|---|---|
Volumetric | L3/L4 | Bandwidth | UDP flood | Scrubbing, anycast capacity |
Protocol | L3/L4 | Connection tables, firewalls | SYN flood | SYN cookies, filtering |
Application | L7 | Web apps, APIs | HTTP flood, Slowloris | WAF, rate limiting, bot detection |
Volumetric Attacks
These try to eat all your bandwidth. A UDP flood is the classic example. It's brute force, measured in bits per second.
Protocol Attacks
These abuse how protocols behave. A SYN flood opens thousands of half finished connections until your firewall or load balancer runs out of room.
Application Layer Attacks
These are sneaky. An HTTP flood looks like normal visitors. Wiz points out that they're the hardest to detect, since they exhaust resources without unusual bandwidth.
What Is a Multivector Attack?
It's an attack that blends several types at once. Cloudflare's H1 2026 report says attackers increasingly combine HTTP floods with network layer attacks, which makes mitigation harder.
DDoS Attack Statistics for 2026
Numbers tell the story better than I can. Here's what the latest data says, and it isn't pretty.
Statistic | Figure | Source |
|---|---|---|
Network layer attacks over 1 Tbps (H1 2026) | 935 | Cloudflare |
Growth in 1 Tbps+ attacks, Q1 to Q2 | +519% | Cloudflare |
Network layer attacks, Q2 vs Q1 | 13.17M vs 10.04M | TechRepublic |
Attacks under 500 Mbps | 96.62% | Help Net Security |
Attacks ending in under 10 minutes | 90.60% | Help Net Security |
Record attack size | 31.4 Tbps | Cloudflare |
Here's what that means for you. Most attacks are small and fast, so manual response is too slow. A few are enormous.
Cloudflare also reports that CLDAP floods, a reflection and amplification attack that abuses exposed Active Directory endpoints, jumped to the number three vector in Q2.
The Dyn Attack: A Real World Example
On October 21, 2016, three waves hit DNS provider Dyn. Wikipedia's summary says the botnet included printers, IP cameras, and baby monitors infected with Mirai. Large platforms became unreachable for many users.
Bitdefender's timeline adds that Mirai had already hit Brian Krebs's site with more than 600 Gbps the month before.
How Do You Know You're Under Attack?
Catch it early and you save hours. Watch for patterns, not just outages.
Warning Signs
Your site is suddenly slow or unreachable
A huge traffic spike from one region or unfamiliar IPs
Floods of identical requests to one page
Server CPU or memory maxed out for no clear reason
How to Protect Your Site: Step by Step
You can't stop attackers from existing. You can make yourself a painful target. CISA advises enrolling in a dedicated DDoS protection service, because standard ISP protections may not cope with larger attacks.
Step 1: Map Your Critical Assets
List what must stay online. Decide what you'd protect first.
Step 2: Put DDoS Mitigation in Front
Use a service that filters traffic before it reaches your origin. Rate limiting, a web application firewall (WAF), and traffic scrubbing do the heavy lifting.
Step 3: Ask Your Providers Hard Questions
Check your ISP and cloud contracts. What do they actually cover? CISA recommends reviewing service agreements to find out.
Step 4: Write and Rehearse a Response Plan
Decide who calls whom, and when. Practice it before you need it. If you've never built one, this guide to what a contingency plan is shows you where to start.
Why Choose [Your Product Name] for DDoS Protection?
Here's the honest case. Attacks now run in seconds, and many hit above 1 Tbps. A person watching a dashboard can't win that race. [Your Product Name] gives you:
Always on, automatic DDoS mitigation
Layer 3, 4, and 7 coverage
Real time dashboards and alerts
[Add your pricing, uptime SLA, or customer proof here]
Don't wait for an outage to cost you customers. Get started with [Your Product Name] today.
Frequently Asked Questions
What is a DDoS attack in simple terms?
It's a flood of fake traffic from many devices that overwhelms a website or server, so real users can't get through.
What is the difference between DoS and DDoS?
A DoS attack comes from one source. A DDoS attack comes from many sources at once, usually a botnet, which makes it harder to block.
What are the three main types of DDoS attacks?
Volumetric (eat bandwidth), protocol (exhaust connection resources), and application layer (overload web apps).
How long does a DDoS attack last?
Most are short. Cloudflare says 90.60% of network layer attacks in H1 2026 ended in under 10 minutes, though some campaigns against targeted groups ran far longer.
Is a DDoS attack illegal?
Yes, in most countries. Launching one against a system you don't own or have permission to test is a crime. Check your local laws.
How can I stop a DDoS attack?
Use an always on mitigation service, apply rate limiting and a WAF, review provider protections, and rehearse a response plan.
Final Thoughts
A DDoS attack is simple in concept and brutal in effect. Know the types, watch the warning signs, and put protection in place before you need it.
