DDoS attacks are among the oldest yet most effective forms of cyberattacks. Although their concept is simple — flood the target with so much traffic that it stops functioning — the scale and sophistication of modern DDoS attacks have reached levels that seemed impossible just a few years ago. Record DDoS attacks today reach volumes measured in terabits per second, and the number of attacks globally grows year after year. Every organization with an internet presence — from a one-person business to a government institution — is a potential target.
In this guide, we explain what exactly a DDoS attack is, how it unfolds step by step, what its types and costs are, and most importantly — what anti-DDoS protection mechanisms can effectively secure your infrastructure against this threat.
What Is a DDoS Attack and How Does It Differ from DoS?
A DDoS (Distributed Denial of Service) attack is a distributed denial-of-service attack that involves simultaneously sending a massive volume of network traffic from multiple sources to overwhelm a victim’s server, network, or application. The result is service unavailability for legitimate users — a website stops responding, an e-commerce system stops accepting orders, and a business application becomes useless.
The key difference between DoS and DDoS lies in the word “Distributed.” A classic DoS attack originates from a single source, making it relatively easy to block (it is enough to identify and cut off the attacker’s IP address). A DDoS attack, on the other hand, uses thousands, and sometimes hundreds of thousands, of compromised devices forming a botnet — a network of infected computers, routers, IoT cameras, and other devices controlled by the attacker. Blocking such distributed traffic is incomparably more difficult because the attack traffic comes from thousands of different IP addresses around the world and is hard to distinguish from legitimate user traffic.
Anatomy of a DDoS Attack — How It Unfolds Step by Step
Understanding the mechanics of a DDoS attack is crucial for effective defense. A typical attack proceeds in several phases.
Phase 1 — Building the Botnet. The attacker infects thousands of devices with malicious software, creating a network of “zombies” (botnet). IoT devices — IP cameras, routers, smart thermostats — are particularly vulnerable due to weak factory-default security settings. The Mirai botnet from 2016, which caused massive outages in the US, consisted of an enormous number of IoT devices. Modern botnets can include millions of devices.
Phase 2 — Target Reconnaissance. Before the attack, reconnaissance of the victim’s infrastructure is conducted: identification of IP addresses, analysis of network architecture, identification of the hosting provider, and any existing anti-DDoS protections. The attacker looks for the weakest link.
Phase 3 — Launching the Attack. The attacker issues a command to the botnet through a Command & Control (C2) server. All infected devices simultaneously begin sending traffic to the target. Within seconds, the traffic volume rises from normal levels to hundreds of gigabits or terabits per second.
Phase 4 — Escalation and Adaptation. Sophisticated attackers do not rely on a single vector. When the victim’s defenses begin filtering volumetric traffic, the attacker switches to protocol attacks or application layer attacks. Modern DDoS attacks are often multi-vector campaigns that dynamically change techniques to bypass defenses.
Phase 5 — Impact and Consequences. The victim’s servers exhaust their resources (bandwidth, CPU, memory, connections). The service becomes unavailable. At the same time, a DDoS attack can serve as a smokescreen for another attack — data theft, backdoor installation, or a ransomware attack.
Three Main Types of DDoS Attacks
DDoS attacks are divided into three categories depending on the layer of the OSI model they target. Each type requires a different approach to defense.
Volumetric Attacks
Volumetric attacks are the most “brute-force” form of DDoS. Their goal is to completely saturate the victim’s network bandwidth with a massive volume of data. The attacker generates traffic with a volume many times exceeding the target’s internet connection bandwidth, effectively blocking all communication.
Most common techniques:
- UDP Flood — flooding the target with UDP packets on random ports. The server must check each packet and respond with an ICMP “Port Unreachable” message, which consumes resources.
- DNS Amplification — the attacker sends DNS queries with a spoofed source address (the victim’s address) to open DNS resolvers. DNS responses are many times larger than queries (amplification factor up to 70x), so the victim receives a torrent of large DNS packets it did not request.
- NTP Amplification — exploits NTP (Network Time Protocol) servers in a similar manner, with an amplification factor of up to 556x.
- Memcached Amplification — the record holder among amplification techniques, with a factor of up to 51,000x. This technique was responsible for the first attack exceeding 1 Tbps (on GitHub in 2018 — 1.35 Tbps).
Volumetric attacks account for the majority of all DDoS attacks. Their volume grows year after year, and record attacks can be very short.
Protocol Attacks
Protocol attacks target weaknesses in network protocols at layers 3 and 4 of the OSI model. Instead of flooding bandwidth, they exhaust the computational resources of network devices — firewalls, load balancers, and the servers themselves.
Most common techniques:
- SYN Flood — the most classic protocol attack. The attacker sends a mass of SYN packets (TCP connection initiation requests) but never completes the three-way handshake. The server allocates resources for each “half-open” connection and eventually exhausts its connection table, ceasing to accept new connections.
- ACK Flood — flooding the server with ACK packets that do not correspond to any active sessions, forcing the server to perform costly connection table lookups.
- Ping of Death — sending improperly formatted or oversized ICMP packets that cause the operating system to crash or restart.
- Smurf Attack — sending ICMP Echo Request packets to a network’s broadcast address with the victim’s spoofed source address. All hosts on the network respond simultaneously to the victim’s address.
Protocol attacks are particularly dangerous because they can effectively incapacitate a service with a relatively low traffic volume. A SYN Flood generating just a few dozen Mbps can be as devastating as a volumetric attack with a volume of hundreds of Gbps.
Application Layer Attacks
Attacks on layer 7 of the OSI model (the application layer) are the hardest to detect because they mimic normal user traffic. Instead of flooding the infrastructure with raw traffic, they target specific application functionalities by sending seemingly legitimate requests that consume a disproportionate amount of server resources.
Most common techniques:
- HTTP Flood — mass sending of HTTP GET or POST requests to resource-intensive endpoints (e.g., search engine, report generation, pages with dynamic content). Each request looks like a normal user visit.
- Slowloris — the attacker opens many HTTP connections to the server and keeps them open for as long as possible by sending HTTP headers in fragments with large delays. The server maintains allocated resources for each “slow” connection until it exhausts the pool of available connections.
- R.U.D.Y. (R-U-Dead-Yet?) — similar to Slowloris, but attacks POST requests by sending form data extremely slowly, byte by byte.
- Cache-Busting Attack — requests deliberately bypass the cache (e.g., by adding random parameters to the URL), forcing the server to process each request from scratch.
Application layer attacks are clearly gaining momentum. They are preferred by sophisticated attackers because they require significantly less bandwidth and are harder to distinguish from normal traffic. An HTTP Flood from just a few hundred bots can incapacitate a web server that handles tens of thousands of normal users without issue.
The Scale of the Problem — Statistics and Trends 2024-2025
DDoS attacks are not slowing down. Key data from industry reports paint a clear picture of the growing threat:
- Attack volume — the number of DDoS attacks mitigated by large providers grows year after year, and record attacks reach volumes measured in terabits per second.
- Frequency — DDoS attacks are launched around the world continuously.
- Duration — most attacks are short, but “low and slow” attacks can drag on for weeks.
- Sector targets — the most frequently attacked industries in 2024 were: financial services, technology and telecommunications, gaming and e-commerce, and the public sector and government administration.
- Motivation — the main motivations include hacktivism (geopolitical conflicts), financial extortion, competitive rivalry, and smokescreens for other attacks.
- Poland and the CEE region — CERT Polska noted a significant increase in DDoS attacks on Polish institutions since 2022, primarily from pro-Russian hacktivist groups (KillNet, NoName057). Banks, government portals, airports, and telecommunications operators were targeted.
A key trend is the democratization of DDoS attacks. DDoS-as-a-Service platforms (DDoS-for-hire, “stressers”) allow anyone, without technical knowledge, to order an attack for a small amount of money. These platforms offer various “packages” — from a few-minute attack at 10 Gbps to multi-hour campaigns exceeding 100 Gbps. According to Europol, in 2024, several such platforms were shut down, but new ones immediately emerge to take their place.
The Cost of DDoS Attacks for Businesses
The financial consequences of a DDoS attack extend far beyond the downtime itself. A company must account for a multidimensional impact on its operations.
Direct downtime costs. Every hour of IT downtime is very costly for large organizations. For e-commerce companies, where every minute of unavailability means lost transactions, costs can be even higher.
Loss of revenue and customers. Many users do not return to a website after a negative experience with its availability. For SaaS companies billed under SLA agreements, violating availability guarantees means financial penalties and the risk of losing contracts.
Mitigation and recovery costs. Responding to an attack during its execution (emergency response), post-breach analysis, strengthening security after the attack, and potential hardware replacement generate additional costs amounting to tens or hundreds of thousands of PLN.
Reputational damage. Service unavailability undermines the trust of customers, partners, and investors. Rebuilding reputation after a high-profile DDoS attack can take months and cost many times more than the attack itself.
Regulatory fines. Organizations subject to NIS2, DORA, or the national cybersecurity system act may face penalties for insufficient security measures and lack of business continuity plans.
In total, taking into account all the aforementioned cost categories, a single DDoS attack is costly for both an SMB and a large organization.
Anti-DDoS Protection Mechanisms — How They Work
Effective anti-DDoS protection is based on a multi-layered approach combining various technologies and techniques. No single mechanism provides complete protection — the key is defense-in-depth.
Scrubbing Centers
Scrubbing centers are specialized data centers through which all network traffic is routed upon detection of an attack. Advanced systems analyze every packet, separating malicious traffic from legitimate traffic. “Cleaned” traffic is forwarded to the client’s servers, while attack traffic is dropped. Providers such as Akamai, Cloudflare, and Imperva operate global networks of scrubbing centers with a combined throughput exceeding tens of Tbps.
Rate Limiting
Rate limiting is a mechanism that restricts the number of requests that can be served from a single IP address or within a single session in a given time window. When the number of requests exceeds a set threshold, excess requests are rejected or queued. This is a particularly effective defense against application layer attacks such as HTTP Flood.
Blackholing and Sinkholing
Blackholing is a “last resort” technique — all traffic destined for the attacked IP address is redirected to a “black hole” (null route) and dropped. It is effective in protecting the rest of the infrastructure, but it means the attacked resource also becomes unavailable to normal users — meaning the attacker effectively achieves their goal. Sinkholing is more selective — it redirects suspicious traffic to a controlled server for analysis while allowing legitimate traffic to pass through.
CDN and Anycast
CDN (Content Delivery Network) networks distribute traffic across hundreds of edge servers around the world. In the event of a DDoS attack, the traffic volume is divided among multiple points of presence (PoP), so no single server is overwhelmed. Anycast technology allows traffic to be directed to the geographically closest (and least loaded) network node, which naturally absorbs volumetric attacks. The networks of the largest providers, such as Cloudflare, have enough capacity to mitigate even the largest known DDoS attacks.
WAF (Web Application Firewall)
A WAF is an application firewall that analyzes HTTP/HTTPS traffic at layer 7. In the context of anti-DDoS protection, a WAF enables filtering of application layer attacks — blocking suspicious request patterns, protecting against Slowloris, detecting anomalies in HTTP headers, and intelligently distinguishing bots from humans (e.g., through JavaScript challenges or CAPTCHA).
BGP Flowspec and Edge Network Filtering
BGP Flowspec allows dynamic creation of traffic filtering rules at the border router level. Upon detecting an attack, filtering rules can be automatically propagated to ISP routers, blocking malicious traffic before it even reaches the organization’s network. This is one of the most effective mechanisms against volumetric attacks.
Anti-DDoS Solutions: On-Premise, Cloud, and Hybrid
Organizations have three main deployment models for anti-DDoS protection to choose from, each with its own advantages and limitations.
On-Premise (Hardware) Solutions
Dedicated appliances from manufacturers such as Radware, Arbor Networks (Netscout), or Fortinet are installed in the client’s infrastructure and analyze traffic in real time. They offer the lowest latency and full control over configuration. However, their limitation is physical throughput — a 40 Gbps appliance cannot defend against a volumetric attack with a volume of 400 Gbps. The cost of purchase and maintenance is also significant (from tens to hundreds of thousands of USD).
Cloud-Based Solutions
Cloud services (Cloudflare, Akamai Prolexic, AWS Shield, Azure DDoS Protection) offer nearly unlimited scalability. Traffic is redirected through the provider’s global infrastructure, where it is filtered before reaching the client’s servers. The billing model is typically a monthly subscription, eliminating large upfront costs. Cloud solutions are particularly effective against volumetric attacks. However, they may introduce additional latency and require traffic to be routed through external infrastructure.
Hybrid Solutions
The hybrid model combines on-premise appliances with a cloud service. The local appliance handles everyday protection and smaller attacks with minimal latency. When the attack volume exceeds the appliance’s capabilities, traffic is automatically switched (“cloud burst”) to a cloud scrubbing center with unlimited throughput. This model is recommended for organizations with critical availability and low-latency requirements — financial services, gaming, telecommunications.
DDoS-as-a-Service — The Democratization of Cybercrime
One of the most alarming trends in recent years is the widespread availability of DDoS-for-hire services, also known as “stressers” or “booters.” These platforms operate on a SaaS model — the user purchases a subscription and, using a simple web panel, can order an attack on any target without any technical knowledge.
Prices for such services on the underground internet are low — from single short attacks to monthly subscriptions with unlimited attacks.
These low barriers to entry mean that DDoS attacks have become a tool not only for organized crime but also for unfair competition, extortion, and even teenage “pranks.” Europol and the FBI regularly shut down such platforms (operations Power Off, Overwatch), but their decentralized nature means that new services immediately emerge to replace those that are closed.
For businesses, this means one thing: a DDoS attack can hit any organization, regardless of size. You do not need to be a bank or a technology giant to become a target. All it takes is for someone to have a motivation — financial, ideological, or simply malicious — and a few dozen dollars.
DDoS Attack Response Plan
Having a DDoS attack response plan before an attack occurs is absolutely crucial. During an attack, there is no time to make decisions from scratch. Every organization should have a documented and tested plan that includes the following steps.
1. Detection and Classification. Automated monitoring systems (SIEM, IDS/IPS, anti-DDoS systems) detect anomalies in network traffic. The SOC team classifies the type and scale of the attack — is it a volumetric, protocol, or application layer attack? What is the volume? What are the vectors?
2. Escalation and Communication. Initiation of the escalation procedure — notifying the incident response team, management, the ISP provider, and the anti-DDoS service provider. Parallel communication with customers and partners about potential disruptions.
3. Protection Activation. Switching traffic through the scrubbing center, activating rate limiting rules, enabling additional filtering mechanisms on WAF and firewalls. In the hybrid model — initiating “cloud burst” to the cloud service.
4. Monitoring and Adaptation. Continuous monitoring of mitigation effectiveness and adaptation of rules in response to changes in attack vectors. Sophisticated attackers change techniques during the attack, so defense must be dynamic.
5. Post-Mortem Analysis. After the attack ends — detailed analysis: where did the traffic originate, what vectors were used, how did the defenses perform, what can be improved. Updating the response plan based on the findings.
6. Regulatory Reporting. If the organization is subject to NIS2 regulations or the national cybersecurity system act, the incident may require reporting to a CSIRT (CERT Polska, CSIRT GOV, or CSIRT MON) within 24 hours.
Protecting Critical Infrastructure from DDoS Attacks
Critical infrastructure — energy, water supply, transportation, telecommunications, healthcare, financial sector — requires a special approach to anti-DDoS protection. An attack on these systems is not just financial losses but a potential threat to human health and life.
The NIS2 Directive, effective in the EU since October 2024, imposes on operators of essential and important services the obligation to implement “appropriate and proportionate technical, operational, and organizational measures” in the area of cybersecurity risk management. This explicitly includes protection against DDoS attacks, business continuity plans, and incident response procedures. Penalties for non-compliance reach 10 million EUR or 2% of annual turnover.
For critical infrastructure, a multi-layered approach is recommended:
- ISP layer — cooperation with the operator in filtering volumetric attacks at the network edge (BGP Flowspec, selective blackholing).
- Cloud layer — dedicated anti-DDoS service with guaranteed SLA and throughput.
- Local layer — on-premise appliances with network microsegmentation and redundancy.
- Application layer — WAF, rate limiting, geo-blocking, bot protection.
- SOC 24/7 — round-the-clock monitoring and immediate response by a dedicated security team.
How nFlo Supports Organizations in DDoS Protection
Protection against DDoS attacks requires not only the right technologies but, above all, the competence of a team that can effectively implement and operate them. nFlo, with experience from over 500 cybersecurity projects and over 200 clients, offers comprehensive support in building multi-layered anti-DDoS protection.
Our SOC (Security Operations Center) operates 24/7/365, ensuring continuous infrastructure monitoring and real-time DDoS attack detection. The incident response time is set out in the contract and differentiated by priority — which in the context of a DDoS attack, where every minute of downtime counts, is critical.
In the event of an active attack, our incident response team coordinates mitigation efforts — from activating cloud protection, through reconfiguring firewalls, to communicating with the ISP and anti-DDoS service providers. We operate both in the prevention phase (designing and implementing protections) and in the response phase (handling active attacks and post-breach analysis).
What the Polish Plenipotentiary’s October 2026 recommendation means for companies that are customers of internet providers — what to ask the operator and what to prepare on your own side — is covered in our article on what the DDoS recommendation for ISPs means for companies.
We deploy protection in the company network and diversion to a scrubbing center as part of the DDoS protection and scrubbing center service, and both can be checked in a controlled DDoS resilience test.
Summary — Key Takeaways
DDoS attacks remain one of the most serious threats to digital service availability. Their growing scale (a record 5.6 Tbps), democratization (DDoS-for-hire for a few dozen dollars), and increasing sophistication (multi-vector attacks, application layer attacks) mean that every organization must treat anti-DDoS protection as a priority.
Effective defense requires a multi-layered approach: a combination of technologies (scrubbing centers, CDN/Anycast, WAF, rate limiting), processes (response plan, regular testing, post-mortem analysis), and people (a competent SOC team operating 24/7). No single product provides complete protection — the key is an integrated strategy covering all layers of infrastructure.
Do not wait for the first attack. The cost of implementing anti-DDoS protection is a fraction of the potential losses from a successful attack. Contact us to discuss how to secure your infrastructure against DDoS attacks.
Related terms
Our services
Related services and products
Frequently asked questions
How much does a DDoS attack cost a company?
One hour of downtime is very costly for large companies. DDoS attacks usually last a few hours or less. Additional costs include: loss of customers, regulatory fines, and reputation rebuilding.
What are the types of DDoS attacks?
Three main types: volumetric (bandwidth flooding — UDP flood, DNS amplification), protocol (resource exhaustion — SYN flood, Ping of Death), application layer (layer 7 attacks — HTTP flood, Slowloris). Modern attacks combine all types.
How does anti-DDoS protection work?
Anti-DDoS systems analyze network traffic in real time, separate legitimate traffic from malicious traffic (scrubbing), filter packets at the network edge, and automatically scale resources. Solutions include: on-premise (appliance), cloud-based (Cloudflare, Akamai), and hybrid.
Does a small business need anti-DDoS protection?
Yes — many DDoS attacks target SMBs. Basic cloud-based protection costs little compared with the cost of one hour of downtime. A DDoS-for-hire attack can be ordered for a small amount of money, making it accessible to anyone.
