A Denial-of-Service (DoS) attack is a cyberattack designed to make a computer system, website, application, network, API, or online service unavailable or extremely slow for legitimate users.

Instead of necessarily trying to steal information, the attacker targets availability, one of the three fundamental objectives represented by the cybersecurity CIA triad:

• Confidentiality – preventing unauthorized disclosure of information.
• Integrity – preventing unauthorized modification of information.
• Availability – ensuring systems and information remain accessible to authorized users.

DoS attacks primarily attack the availability component.

A simple example is a web server capable of processing a certain number of requests simultaneously. If an attacker generates enough malicious requests to consume the server's processing capacity, memory, network connections, or available bandwidth, legitimate customers may no longer be able to access the website.

The result may be:

• Very slow website performance
• Connection timeouts
• HTTP 5xx errors
• Application crashes
• Network congestion
• High CPU or RAM utilization
• Exhausted connection tables
• Website or service downtime
• Legitimate users being unable to connect

What Is a Distributed Denial-of-Service (DDoS) Attack?

A Distributed Denial-of-Service (DDoS) attack is a more distributed form of denial-of-service attack in which malicious traffic comes from many systems or devices simultaneously instead of primarily from one attacking source.

The word distributed is the key difference.

A DDoS attack may involve hundreds, thousands, or potentially far more compromised devices spread across different networks and geographic locations.

These devices can include:

• Desktop computers
• Servers
• Virtual machines
• Routers
• Internet-connected cameras
• DVRs
• IoT devices
• Compromised cloud resources
• Other internet-connected systems

A large collection of compromised devices controlled for malicious activity is commonly called a botnet.

Each compromised device participating in the botnet may be called a bot or zombie.

When many of these devices send traffic toward the same target simultaneously, the combined traffic can overwhelm the target's network, infrastructure, application, or upstream connectivity.

What Is the Difference Between DoS and DDoS?

Although both attacks attempt to disrupt availability, their architecture differs significantly.

Characteristic	DoS	DDoS
Meaning	Denial of Service	Distributed Denial of Service
Attack sources	Usually one or relatively few sources	Many distributed sources
Typical architecture	Centralized	Distributed
Traffic volume	Often lower	Can become extremely large
Blocking source IPs	Sometimes relatively practical	Usually much more difficult
Botnet required	No	Common, but not the only possibility
Geographic distribution	Usually limited	Potentially worldwide
Detection	Often easier	Can be significantly harder
Mitigation complexity	Generally lower	Often much higher
Potential scale	Limited by attacking resources	Can combine resources of many devices

Therefore:

A DoS attack attempts to deny service, while a DDoS attack achieves the same objective using distributed attack sources.

How Does a DDoS Attack Work?

A DDoS attack typically works by generating enough unwanted traffic, requests, connections, or resource-intensive activity to exhaust one or more resources required by the target.

Conceptually:

Many attack sources → Internet → Target infrastructure → Resource exhaustion → Legitimate users experience disruption

The targeted resource could be:

• Internet bandwidth
• Firewall capacity
• Router capacity
• Connection tracking tables
• Load balancer capacity
• TCP connections
• CPU
• RAM
• Web server workers
• Application threads
• Database connections
• API capacity
• Backend services

This distinction is important because DDoS does not always mean simply "sending huge amounts of bandwidth."

Some attacks consume network capacity, while others attempt to exhaust protocol state or application resources.

 

 

Simplified DDoS Attack Lifecycle

Stage 1: Systems Become Compromised

Attackers may compromise vulnerable internet-connected devices or systems.

The attacker may attempt to build or obtain access to a network of compromised devices.

These devices collectively form a botnet.

Stage 2: Devices Become Remotely Controlled

Compromised devices can communicate with attacker-controlled infrastructure.

Depending on the malware and botnet architecture, attackers may use command-and-control mechanisms to coordinate malicious activity.

Importantly, the legitimate owner of a compromised device may have no idea that the device is participating in malicious activity.

Stage 3: The Target Is Selected

The attacker selects an internet-accessible target such as a:

• Website
• Web application
• API
• DNS service
• Gaming platform
• E-commerce service
• Cloud application
• Corporate network
• Internet-facing server

Stage 4: Distributed Traffic Reaches the Target

Large numbers of participating systems begin generating traffic or requests toward the victim.

Because the traffic originates from many different sources, simple blocking based on one source IP address is usually ineffective.

Stage 5: Resources Become Exhausted

Depending on the attack, the victim may run out of:

• Bandwidth
• Connections
• Processing capacity
• Memory
• Application workers
• Database connections
• Network-device resources

Stage 6: Legitimate Users Are Affected

Once available capacity becomes exhausted, genuine requests may be delayed, rejected, or dropped.

Users may see messages such as:

Connection timed out

503 Service Unavailable

502 Bad Gateway

504 Gateway Timeout

or the website may simply stop responding.

Major Categories of DoS and DDoS Attacks

DDoS attacks are commonly divided into three broad categories.

1. Volumetric Attacks

Volumetric attacks attempt to consume available network bandwidth by generating extremely large quantities of traffic.

The objective can be thought of as:

Attack traffic > available network capacity

If an internet connection has finite bandwidth and malicious traffic consumes most or all of it, legitimate traffic may not reach the destination effectively.

Examples associated with volumetric attacks include:

• UDP floods
• ICMP floods
• Reflection attacks
• Amplification attacks

These attacks are commonly measured in metrics such as:

• Mbps
• Gbps
• Tbps

depending on their scale.

2. Protocol or State-Exhaustion Attacks

Protocol attacks target weaknesses or finite resources in networking protocols and infrastructure.

Instead of only attempting to fill bandwidth, the attacker may try to exhaust connection tables, firewall resources, load balancers, or server networking stacks.

A well-known example is a SYN flood.

Understanding a SYN Flood

A normal TCP connection generally begins with the TCP three-way handshake:

Client → SYN → Server

Server → SYN-ACK → Client

Client → ACK → Server

The connection can then be established.

During a SYN flood, large numbers of connection attempts can cause systems to maintain many incomplete or half-open connections.

If enough resources are consumed, legitimate users may experience difficulty establishing new connections.

Modern operating systems, network appliances, and mitigation platforms include protections against such attacks, but SYN floods remain an important DDoS concept.

3. Application-Layer Attacks

Application-layer attacks target services such as:

• HTTP
• HTTPS
• APIs
• Search functions
• Login pages
• Dynamic web applications

These are frequently associated with Layer 7, the application layer of the OSI model.

Unlike massive bandwidth floods, an application-layer attack may use comparatively less traffic while attempting to consume expensive application resources.

For example, repeated requests to computationally expensive pages could consume:

• CPU
• Application workers
• Database connections
• Database processing time
• Memory
• Backend API resources

This can make Layer 7 attacks particularly challenging because malicious HTTP requests may resemble legitimate user activity.

What Is an HTTP Flood?

An HTTP flood is an application-layer denial-of-service technique involving excessive HTTP requests against a website or web application.

Targets might include resource-intensive functionality such as:

• Search
• Login
• Product queries
• Dynamic reports
• Database-driven pages
• API endpoints

The security challenge is distinguishing malicious automated traffic from legitimate customer activity without unnecessarily blocking genuine visitors.

What Are Reflection and Amplification Attacks?

Reflection and amplification are important concepts in DDoS security.

Reflection

In a reflection attack, third-party internet systems are abused so that response traffic is directed toward the victim.

This can obscure the original attack source and distribute traffic through intermediary systems.

Amplification

Amplification occurs when relatively small requests can trigger significantly larger responses.

Attackers attempt to abuse this difference so that the amount of traffic reaching the victim is much larger than the traffic needed to trigger those responses.

Historically, improperly configured or exposed UDP-based services have been abused for reflection/amplification attacks.

The defensive lesson for administrators is important:

Do not expose unnecessary network services to the public internet, and configure internet-facing services according to current security best practices.

Why Are DDoS Attacks Difficult to Stop?

DDoS attacks are challenging because they can originate from large numbers of unrelated IP addresses.

Blocking one IP address might have almost no effect.

Additionally, defensive systems need to determine:

Which traffic is legitimate and which traffic is malicious?

For a popular website, both legitimate and malicious users may generate:

• HTTP GET requests
• HTTPS connections
• API requests
• DNS requests
• TCP connections

Overly aggressive filtering can therefore create another problem: legitimate users may also get blocked.

Effective DDoS protection requires intelligent traffic analysis rather than simply blocking every high-volume source.

Common Signs of a DoS or DDoS Attack

Possible indicators include:

• Website suddenly becomes extremely slow
• Large unexplained increase in inbound traffic
• Network bandwidth reaches maximum utilization
• Sudden increase in requests per second
• High number of connections from unusual sources
• Large numbers of incomplete connections
• Firewall connection tables become exhausted
• Server CPU unexpectedly reaches very high utilization
• Web server processes become overloaded
• API response times increase dramatically
• Large number of HTTP 429, 502, 503, or 504 responses
• Users report intermittent connectivity
• Monitoring shows unusual geographic traffic patterns
• Unusual increases in packets per second
• Similar requests repeatedly target one endpoint

However, these symptoms do not automatically prove that a DDoS attack is occurring.

Hardware failure, software bugs, legitimate traffic spikes, database problems, network outages, DNS problems, application errors, or misconfiguration can produce similar symptoms.

Proper investigation is essential.

How Can Organizations Detect DDoS Attacks?

Detection should involve multiple sources of information.

1. Establish Normal Traffic Baselines

Organizations should understand normal patterns for:

• Bandwidth
• Requests per second
• Packets per second
• Concurrent connections
• CPU utilization
• Memory utilization
• Geographic traffic
• API activity

Significant deviations can trigger investigation.

2. Monitor Network Traffic

Network monitoring can identify:

• Unexpected bandwidth spikes
• Unusual protocol distribution
• Abnormal connection rates
• Excessive packets per second
• Unusual source patterns

3. Monitor Application Behavior

Application monitoring should track:

• Response times
• HTTP status codes
• Request rates
• Database latency
• API failures
• Worker utilization
• Queue depth

4. Centralize Security Logs

A SIEM or centralized logging platform can correlate events from:

• Firewalls
• Routers
• Web servers
• WAFs
• IDS/IPS systems
• Applications
• DNS infrastructure
• Cloud services

How Can Organizations Protect Against DDoS Attacks?

There is no single configuration that protects every organization from every type of DDoS attack.

A layered approach is recommended.

1. Use Dedicated DDoS Protection

Organizations with important public-facing infrastructure should consider upstream or cloud-based DDoS mitigation.

Such services can identify malicious traffic before it reaches the organization's origin infrastructure.

2. Use a Content Delivery Network

A Content Delivery Network (CDN) distributes content across geographically distributed infrastructure.

A properly configured CDN can:

• Reduce load on origin servers
• Cache static content
• Absorb traffic across distributed infrastructure
• Hide or shield origin infrastructure when configured correctly
• Integrate with DDoS mitigation capabilities

3. Deploy a Web Application Firewall

A Web Application Firewall (WAF) can help identify and filter malicious HTTP/HTTPS traffic.

It can be particularly useful against application-layer attacks.

4. Implement Rate Limiting

Rate limiting restricts the number of requests that clients can make during a defined period.

It can help protect:

• Login endpoints
• APIs
• Search pages
• Expensive application operations

Rate limits must be carefully designed so legitimate users, NATed networks, proxies, or business integrations are not unintentionally blocked.

5. Use Load Balancing

Load balancers distribute legitimate workload across multiple backend systems.

Load balancing improves availability and scalability, although it should not be treated as a replacement for dedicated DDoS mitigation.

A sufficiently large attack can also overwhelm a load balancer or its upstream connectivity.

6. Protect the Origin Server

When using reverse proxies, CDNs, or cloud protection services, organizations should avoid unnecessarily exposing the origin server directly to the internet.

Otherwise, attackers may bypass the protection layer and attack the origin directly.

7. Use Firewall and Network Filtering

Firewalls and upstream filtering can help block clearly unwanted traffic.

Depending on infrastructure and provider capabilities, defensive controls may include:

• Access control lists
• IP reputation
• Connection limits
• Protocol validation
• Geographic restrictions where appropriate
• Rate controls
• Network anomaly detection

8. Keep Systems Updated

DDoS protection is not only about the victim.

Compromised servers, routers, IoT devices, and other vulnerable systems can become part of botnets.

Organizations should therefore:

• Install security updates
• Remove unsupported software
• Change default credentials
• Disable unnecessary services
• Restrict management interfaces
• Use strong authentication
• Monitor internet-facing devices

9. Build Redundancy

Critical systems should avoid unnecessary single points of failure.

Depending on business requirements, redundancy may include:

• Multiple servers
• Multiple availability zones
• Redundant DNS
• Multiple network paths
• Load-balanced infrastructure
• Autoscaling
• Geographic distribution

10. Prepare a DDoS Incident Response Plan

Organizations should know what to do before an attack occurs.

The plan should identify:

• Hosting provider contacts
• ISP escalation contacts
• DDoS mitigation provider contacts
• Internal technical owners
• Communication procedures
• Logging requirements
• Escalation thresholds
• Business-critical services
• Recovery procedures

What Should You Do During a Suspected DDoS Attack?

If a business suspects a DDoS attack:

1. Confirm whether the issue is actually traffic-related.
2. Check network, server, application, DNS, and firewall monitoring.
3. Determine whether bandwidth, connections, CPU, memory, or application resources are exhausted.
4. Preserve relevant logs.
5. Contact the hosting provider or ISP where necessary.
6. Activate DDoS mitigation services.
7. Apply carefully tested filtering or rate controls.
8. Protect critical application endpoints.
9. Monitor legitimate-user impact.
10. Document the incident for later investigation.

Avoid making large, untested firewall changes during an outage unless the impact is understood. Emergency filtering that is too broad can block legitimate customers and worsen the outage.

DoS vs DDoS Example

Consider an online shopping website.

Under normal conditions:

5,000 legitimate visitors → Website → Normal operation

During a DoS attack:

One malicious source → Excessive requests → Website → Performance degradation

During a DDoS attack:

Thousands of distributed devices → Coordinated unwanted traffic → Website infrastructure → Resource exhaustion

Meanwhile:

Legitimate customers → Website → Slow response / timeout / unavailable

This demonstrates why distributed attacks can be significantly harder to mitigate.

Does a DDoS Attack Mean the Website Has Been Hacked?

Not necessarily.

A successful DDoS attack demonstrates an availability problem, but it does not automatically mean the attacker gained unauthorized access to the server or stole information.

However, organizations should still investigate thoroughly.

Security teams should determine whether the DDoS event coincided with:

• Unauthorized login attempts
• Malware activity
• Exploitation attempts
• Data exfiltration
• Account compromise
• Configuration changes
• Other suspicious activity

A traffic flood should never be assumed to be the only malicious activity occurring during an incident.

Can a Firewall Stop a DDoS Attack?

A firewall can be an important part of DDoS defense, but it cannot guarantee protection.

For example, if an organization's internet connection can handle significantly less traffic than an attacker sends, the connection may become saturated before traffic even reaches the local firewall.

In that situation, filtering must occur upstream.

This is why large-scale DDoS protection is frequently provided by:

• ISPs
• Hosting providers
• CDNs
• Cloud security networks
• Dedicated DDoS mitigation providers

Can DDoS Attacks Affect Cloud Servers?

Yes.

Cloud infrastructure does not automatically make an application immune to DDoS attacks.

Cloud platforms can provide significant scalability and DDoS protection capabilities, but application architecture and configuration still matter.

Possible targets include:

• Public IP addresses
• Web applications
• APIs
• DNS services
• Load balancers
• Authentication services
• Application servers
• Databases indirectly overloaded through application requests

Organizations should understand the DDoS protections included with their cloud platform and determine whether additional protection is required.

Can Small Businesses Be Targeted by DDoS?

Yes.

DDoS is not limited to large enterprises.

Potential targets include:

• Small e-commerce websites
• Hosting companies
• SaaS applications
• Gaming services
• Educational institutions
• Professional-service firms
• Online portals
• APIs
• Remote-access infrastructure

Small businesses can sometimes be more vulnerable because they may have limited bandwidth, fewer redundant systems, and no dedicated security operations team.

DDoS Protection Checklist

Organizations operating public-facing services should consider the following defensive checklist:

• Maintain an inventory of internet-facing services.
• Remove unnecessary public services.
• Patch internet-facing systems promptly.
• Use strong authentication for management interfaces.
• Monitor normal bandwidth and application baselines.
• Configure network and application alerts.
• Deploy WAF protection where appropriate.
• Implement sensible rate limits.
• Consider CDN-based protection.
• Protect or restrict origin-server access.
• Maintain redundant DNS infrastructure where required.
• Review ISP and hosting-provider DDoS capabilities.
• Centralize firewall and server logs.
• Maintain an incident-response procedure.
• Test escalation contacts periodically.
• Review DDoS protections after major infrastructure changes.

Frequently Asked Questions (FAQ)

1. What is a DoS attack?

A Denial-of-Service attack attempts to make a system, network, website, or application unavailable to legitimate users by exhausting resources or otherwise disrupting normal service.

2. What is a DDoS attack?

A Distributed Denial-of-Service attack is a denial-of-service attack generated from multiple distributed systems or devices.

3. What is the main difference between DoS and DDoS?

The primary difference is distribution. A traditional DoS attack generally originates from one or relatively few sources, while a DDoS attack uses many distributed sources simultaneously.

4. What is a botnet?

A botnet is a collection of compromised internet-connected systems that can be remotely controlled for malicious activities.

5. How does a DDoS attack work?

A DDoS attack generates distributed traffic or requests toward a target until bandwidth, network state, server capacity, or application resources become overloaded.

6. Does DDoS always use huge bandwidth?

No. Volumetric attacks may consume enormous bandwidth, while application-layer attacks may attempt to exhaust application resources with substantially less network traffic.

7. What is a volumetric DDoS attack?

It is an attack designed primarily to consume available network bandwidth with large quantities of unwanted traffic.

8. What is a Layer 7 DDoS attack?

A Layer 7 or application-layer attack targets application services such as websites, APIs, login systems, or other HTTP/HTTPS functionality.

9. What is an HTTP flood?

An HTTP flood involves excessive HTTP requests designed to consume web-server or application resources.

10. What is a SYN flood?

A SYN flood attempts to create large numbers of incomplete TCP connection attempts, potentially consuming connection-related resources.

11. What is a DDoS amplification attack?

An amplification attack abuses services where a relatively small request can generate a larger response, increasing the traffic directed toward the victim.

12. What is a reflection attack?

A reflection attack uses third-party systems to send responses toward the victim rather than sending all traffic directly from the original source.

13. Can a firewall prevent DDoS attacks?

A firewall can help filter some attacks, but large attacks may saturate upstream network capacity before traffic reaches the firewall. Upstream mitigation may therefore be necessary.

14. Can a CDN protect against DDoS?

A CDN can significantly improve resilience by distributing traffic and providing large-scale mitigation capabilities, depending on the provider and configuration.

15. Can a WAF stop DDoS attacks?

A WAF can help mitigate certain application-layer attacks but should be one component of a broader DDoS defense strategy.

16. How can I tell whether my website is under DDoS attack?

Indicators can include sudden traffic spikes, unusually high connection rates, bandwidth saturation, abnormal request patterns, increased errors, and service degradation. These symptoms should be investigated because legitimate technical failures can appear similar.

17. Can DDoS attacks steal data?

The primary purpose of DDoS is usually service disruption rather than data theft. However, organizations should investigate whether other malicious activities occurred at the same time.

18. Can cloud-hosted websites experience DDoS attacks?

Yes. Cloud platforms provide various protections and scalability features, but cloud-hosted applications can still be targeted.

19. Can small businesses be attacked by DDoS?

Yes. Any internet-accessible organization or service can potentially be targeted.

20. Should organizations have a DDoS response plan?

Yes. Organizations running business-critical online services should establish escalation contacts, monitoring procedures, mitigation options, and recovery processes before an incident occurs.

Conclusion

DoS and DDoS attacks are availability-focused cyberattacks designed to prevent legitimate users from accessing networks, websites, applications, APIs, or online services.

The most important distinction is that DoS attacks generally rely on one or relatively few attack sources, whereas DDoS attacks distribute malicious activity across many systems.

DDoS attacks can target different layers of infrastructure. Some attempt to consume bandwidth, others exhaust networking resources, and application-layer attacks attempt to overwhelm web applications or backend systems.

Organizations should therefore avoid relying on a single defensive technology. Effective DDoS resilience generally combines network monitoring, traffic baselining, upstream mitigation, CDN services, WAF protection, rate limiting, secure infrastructure configuration, redundancy, logging, and a documented incident-response plan.

For businesses whose websites, APIs, portals, or cloud applications are operationally critical, DDoS protection should be treated as part of overall business continuity, cybersecurity, and availability planning, rather than merely as a firewall configuration issue.

50 #Tags

#DoS #DDoS #DenialOfService #DistributedDenialOfService #DDoSAttack #DoSAttack #CyberSecurity #NetworkSecurity #CyberAttack #CyberThreats #DDoSProtection #DDoSMitigation #DDoSPrevention #DoSProtection #Botnet #BotnetAttack #NetworkAttack #WebsiteSecurity #ServerSecurity #CloudSecurity #InformationSecurity #CyberSecurityAwareness #VolumetricAttack #Layer7Attack #ApplicationLayerAttack #HTTPFlood #SYNFlood #UDPFlood #DNSAmplification #ReflectionAttack #AmplificationAttack #NetworkMonitoring #TrafficMonitoring #WebApplicationFirewall #WAF #FirewallSecurity #RateLimiting #CDN #CloudSecurity #IncidentResponse #SecurityMonitoring #SIEM #SOC #NetworkInfrastructure #WebsiteProtection #ServerProtection #CyberDefense #DataSecurity #ITSecurity #SecurityAwareness