DDoS

TL;DR — what is DDoS and how to protect against it

DDoS (Distributed Denial of Service) is a distributed attack that floods a service with traffic from thousands of sources (botnets, amplifiers) until resources (bandwidth, CPU, RAM, connection pool) are exhausted. Effective defense is multi-layered (network + transport + application + CDN scrubbing) — no single product “solves DDoS”.

• Scale 2024-2026: record attacks exceeded 5.6 Tbps (Cloudflare, October 2024, UDP flood); HTTP/2 Rapid Reset reached 398 million requests per second (CVE-2023-44487).
• Main vectors: SYN flood (L4), UDP amplification (DNS, NTP, Memcached, CLDAP), HTTP flood (L7), Slowloris (L7), HTTP/2 Rapid Reset.
• Defense stack: Anycast CDN (Cloudflare, Fastly, Akamai), scrubbing service (Cloudflare Magic Transit, Akamai Prolexic, AWS Shield Advanced, NETSCOUT Arbor), rate limiting (WAF, Nginx limit_req), traffic engineering (BGP blackhole), resilient architecture (auto-scaling, multi-region failover).
• Defense goal: not zero attacks — but mitigation in <60 seconds from detection.

What is DDoS?

DDoS (Distributed Denial of Service) is a type of cyberattack that overloads a system or network service by flooding it with an enormous amount of fake traffic, leading to resource unavailability for legitimate users.

DDoS Attack Definition

A DDoS attack (Distributed Denial of Service attack) is a coordinated attack on the availability of a system or network service, conducted simultaneously from multiple sources. The goal is to overload the attacked target’s resources and prevent it from functioning normally.

How Does a DDoS Attack Work?

• The attacker takes control of a large number of computers (botnet)

• Computers in the botnet receive commands to send an enormous number of requests to the attack target

• The attack target is flooded with fake traffic that exhausts its resources

• Legitimate users cannot use the service due to overload

Types of DDoS Attacks

• Volumetric Attacks: Flood the network link with an enormous amount of traffic.

• Protocol Attacks: Exploit vulnerabilities in network protocols.

• Application Layer Attacks: Target specific services or applications.

DDoS vs DoS vs botnet — attack vector comparison

Vector	OSI layer	Goal	Example	Defense
SYN Flood	L4 (Transport)	Exhaust connection table	Booter services, Mirai	SYN cookies, rate limit, scrubbing
UDP Amplification (DNS/NTP/Memcached)	L3-4	Bandwidth saturation via reflection	GitHub 1.35 Tbps (Memcached, 2018), AWS 2.3 Tbps (CLDAP, 2020)	UDP blackhole, BCP38, scrubbing
HTTP Flood (L7)	L7 (Application)	Exhaust CPU / app connection pool	Mirai HTTP, BlackNurse	WAF, JS challenge, CAPTCHA, Bot Fight
Slowloris / Slow Read	L7	Exhaust connection pool with slow requests	Apache pre-2.2 vulnerable	Connection timeout, mod_reqtimeout, reverse proxy
HTTP/2 Rapid Reset	L7	Stream multiplexing abuse — 398M rps	Cloudflare/Google/AWS 2023 (CVE-2023-44487)	Patch HTTP/2 servers, rate limit streams
Ransom DDoS (RDoS)	L3-7 mixed	Extort ransom (note before or during attack)	Fancy Bear, REvil RDoS, NoName057(16)	Scrubbing + DON’T pay + report to CSIRT/CERT
DoS (single source)	any	One attacker machine hitting one victim	LOIC, HOIC (legacy)	Trivial IP block, firewall
Botnet (infrastructure)	underlying	Network of compromised devices (zombies) used as a tool	Mirai (IoT), Mēris, MyKings	Botnet takedown (LE ops), ISP-level filtering

Key DDoS vs DoS difference: DoS comes from one source — trivial to block (single IP in firewall). DDoS is distributed (thousands of IPs simultaneously, typically a botnet) — impossible to stop by blocking individual IPs, requires distributed scrubbing infrastructure. A botnet is not an attack type — it is the infrastructure attackers use to launch DDoS (or other operations: spam, crypto theft, credential stuffing).

Goals and Motivations of DDoS Attacks

• Disrupting competitor operations

• Extortion (ransom demands)

• Protest or activism (hacktivism)

• Diverting attention from other attacks

• Demonstrating power or skills

Threats Associated with DDoS Attacks

• Service downtime and financial losses

• Loss of reputation and customer trust

• Costs related to protection and system repair

• Possibility of data leaks during the attack

• Disruptions in supply chain and business processes

Examples of Famous DDoS Attacks

• Attack on Dyn DNS in 2016

• Attacks on banks and cryptocurrency exchanges

• Attacks on government services and critical infrastructure

How to Detect DDoS Attacks?

• Network traffic monitoring

• Traffic pattern and anomaly analysis

• Using intrusion detection systems (IDS/IPS)

• Monitoring server and application performance

Methods of Protection Against DDoS Attacks

• Increasing bandwidth and infrastructure redundancy

• Using CDN (Content Delivery Network) services

• Implementing web application firewalls (WAF)

• Using specialized anti-DDoS services

• Traffic filtering at the internet service provider level

What to ask your internet provider and what to prepare on the company side is covered in our article on what the DDoS recommendation for ISPs means for companies.

How to protect against DDoS — step-by-step playbook

Effective DDoS defense is not a single technology, but a three-layer program: prevention (before the attack), detection (in the first minutes), mitigation (during), and postmortem (after). Each layer has its own concrete actions and tools.

Prevention — what to do before the attack

The cheapest defense is preparing infrastructure before the first attack. In practice this takes 1-4 weeks of implementation and drastically reduces impact when an attack actually arrives.

• Hosting/CDN with native anti-DDoS protection — choose a provider with native scrubbing capacity: Cloudflare (Free/Pro/Business/Enterprise/Magic Transit), AWS Shield Standard/Advanced, Akamai Prolexic, Imperva, Radware DefensePro, NETSCOUT Arbor Edge Defense, Azure DDoS Protection, GCP Cloud Armor. Rule of thumb: provider scrubbing capacity must be at least 10× larger than the largest recent attack in your industry (2026: >50 Tbps total capacity).
• DDoS-resilient architecture:
  • Anycast routing — single IP distributed geographically; traffic routes to the nearest PoP (Cloudflare has >300 PoPs globally, Fastly ~80).
  • Multi-region failover — active instances across 2-3 regions (eu-central, eu-west, us-east), auto-cutover when one is overloaded.
  • Auto-scaling with circuit breakers — Kubernetes HPA, AWS Auto Scaling Groups, Azure VMSS; with circuit breakers so you do not scale infinitely under attack (cost runaway).
  • Static assets cached aggressively — Cache-Control: max-age=31536000 immutable, push to CDN edge for everything that does not need personalization.
• Rate limiting at every layer:
  • Nginx: limit_req_zone + limit_conn_zone — typically 10-50 req/s per IP, 50-200 connections per IP.
  • Cloudflare WAF Rate Limiting Rules (Pro+) — 100 req/min default per IP, custom thresholds per endpoint.
  • AWS WAF rate-based rules — 2,000 req per 5 min per IP, integrates with Shield Advanced.
• Infrastructure hardening:
  • Close unused UDP ports — especially 11211 (Memcached), 1900 (SSDP/UPnP), 53 (DNS) only on internal resolvers, 123 (NTP) egress-only.
  • Hide origin IP behind CDN — the origin server must not be directly reachable. Cloudflare Authenticated Origin Pulls enforces that only Cloudflare traffic reaches origin.
  • Origin allow-list — origin firewall accepts traffic only from CDN provider ASNs (Cloudflare ASN 13335, Fastly ASN 54113).
  • SYN cookies enabled — net.ipv4.tcp_syncookies = 1 on Linux, defends against SYN flood exhausting the connection table.
• Provisioning — bandwidth overprovisioning 5-10× baseline (if baseline is 100 Mbps, link should be 1 Gbps), CPU/RAM headroom min. 40% at peak hours.
• DNS protection — choose a second, independent DNS provider (primary Cloudflare + backup AWS Route 53 or Google Cloud DNS); a DDoS on primary DNS should not kill the entire domain.
• Monitoring + anomaly detection — Datadog, Grafana with Prometheus, AWS CloudWatch, Cloudflare Analytics; baseline traffic per hour/day of week + alert on >3-sigma deviation.

Detection during the attack — first 5 minutes

Detection is critical because every minute of delay means rising costs and lost customers. Signals to check immediately:

• Traffic spike >5× baseline within <1 minute (legitimate growth is usually gradual; viral traffic has a different user-agent fingerprint).
• CPU / connection pool saturation — utilization >85% on application servers without matching growth in legitimate transactions.
• Error rate 5xx > 1% — backend cannot keep up, p99 latency rises from 200ms to >2000ms.
• TCP retransmits + SYN backlog overflow — netstat -s | grep -i syn shows thousands of pending SYN-ACK.

Detection tools: AWS Shield metrics (DDoSDetected event), Cloudflare Analytics (Under Attack triggers automatically), Datadog DDoS dashboards, NetFlow/sFlow analysis (nfdump, pmacct). First 5 minutes: confirm DDoS (vs legitimate viral traffic, vs misconfiguration), classify (L3-4 volumetric vs L7 application), enable scrubbing (one click in Cloudflare “I’m Under Attack” mode).

Mitigation playbook — during the attack

L3-4 attacks (SYN flood, UDP amplification, ICMP flood):

• Null-route offending IPs/ASNs — BGP blackhole at ISP (RTBH — Remotely Triggered Black Hole), effective for volumetric.
• Anycast distribution — automatically spreads the attack across all PoPs; most IoT-botnet attacks lack the capacity to hit every region simultaneously.
• Scrubbing service — redirect traffic (BGP announce) to a cleaning center (Cloudflare Magic Transit / Akamai Prolexic); “clean traffic” returns to origin via GRE tunnel.

L7 attacks (HTTP flood, Slowloris, HTTP/2 Rapid Reset):

• WAF rules block fingerprints — Cloudflare Managed Rules, AWS WAF Bot Control, F5 BIG-IP ASM; Mirai and derivative signatures.
• JS challenge / CAPTCHA — Cloudflare Challenge Page, Google reCAPTCHA v3, hCaptcha; eliminates 99% of bot traffic at the cost of 2-5% conversion rate (acceptable during an attack).
• Bot Fight Mode / Super Bot Fight Mode — Cloudflare Pro/Business; ML detection of bot vs human.
• Geo-blocking — if attack originates from a country you do not serve, drop traffic at WAF level (watch business impact!).
• Session rate limiting per IP/cookie/JA3 — TLS fingerprint blocking for custom implants.

Application-layer hardening on the fly:

• Aggressive Cache-Control — switch dynamic to a cached fallback during the attack (cache-everything mode in Cloudflare).
• Connection limits per IP — Nginx limit_conn_zone, HAProxy maxconn.
• Aggressive request timeout — default 300s in production; lower to 10-30s during an attack to free resources.

Communication:

• Status page — Statuspage.io, Atlassian Statuspage; “Investigating elevated error rates” beats silence.
• CSIRT/CERT — report ransom DDoS immediately to CISA (USA), NCSC (UK), CERT Polska (Poland, incydent.cert.pl), or your national CERT; NEVER pay the ransom — CERTs help with scrubbing relationships and may share IOCs across the industry.
• Enterprise customers — proactive email update (better “we know, we are acting, ETA 30min” than silence).

Postmortem — after the attack

• IR runbook update — what worked, what did not; lessons learned per NIST SP 800-61 Rev 2 (Detection → Containment → Eradication → Recovery → Lessons Learned).
• Logs forensics — NetFlow, WAF logs, application logs; archive for 90-365 days (DORA/NIS2 require retention).
• ASN blocklists update — add attacking ASNs to allow-list/deny-list (caveat: offensive ASNs are often legitimate ISPs with compromised customers — full-ASN geo-blocking is a last resort).
• Tabletop exercise quarterly — simulate DDoS scenarios, especially ransom DDoS with a 24h ultimatum.
• Tier-up DDoS protection — if the attack exceeded current capacity, time to upgrade (Cloudflare Pro → Business → Enterprise; AWS Shield Standard → Advanced).

Industry-specific guidance

• E-commerce — Cloudflare Magic Transit or AWS Shield Advanced + emergency provisioning for Black Friday / Cyber Monday (targeted attacks during peak seasons); aggressive cache for product listings, dynamic only for checkout.
• B2B SaaS — API rate limiting per tenant (50-1,000 req/min/tenant with burst capacity), JWT-based authentication protects against credential-stuffing-driven DDoS.
• Gaming / streaming — Anycast UDP scrubbing (game traffic is UDP-heavy, classical L7 protection does not apply); partner with a gaming-aware provider (Cloudflare Spectrum, AWS GameLift).
• Critical infrastructure / utilities — NIS2 and DORA require documented continuity controls, quarterly DR tests; relationships with national CERTs are obligatory for essential entities.
• Financial sector — DORA (Digital Operational Resilience Act, in force since 17 January 2025) requires resilience testing including DDoS scenarios under Article 8-12 ICT operational resilience, plus reporting of significant incidents to EBA / national regulator (KNF in Poland) within 24h.

Best Practices for DDoS Protection

• Developing an incident response plan

• Regular DDoS resilience testing

• Employee training on recognizing and responding to attacks

• Cooperation with internet service providers and security specialists

• Continuous monitoring and updating of protection systems

Related Terms

• DoS (Denial of Service) — single-source attack, the fundamental difference vs DDoS
• Botnet — network of infected devices (zombies) used as a DDoS tool
• Bot — a single compromised device, a node in a botnet
• Firewall — first line of defense against network attacks
• WAF (Web Application Firewall) — key control for L7 DDoS mitigation (HTTP flood, Slowloris)
• Incident Response — playbook for reacting to an active DDoS attack
• Business Continuity — keeping services available under attack
• Security Controls — broader category in which DDoS protection is one element

Explore Our Services

Want to protect your organization against DDoS attacks? Check out:

• SOC 24/7 - monitoring and rapid attack response
• Incident Response - support during active attacks
• Security Audits - DDoS resilience assessment
• DDoS Protection and Scrubbing Center - protection in the network and in the cloud, diversion preparation
• DDoS Resilience Testing - a controlled test of protection and procedures

DDoS attacks pose a serious threat to online organizations. Effective protection requires a comprehensive approach combining technology, processes, and education.