What is a DDoS Attack
A DDoS attack attempts to make a service unavailable by exhausting bandwidth, packet processing capacity, connection state or application resources.
Network & DDoS Reference
Technical reference pages covering packet floods, routing controls, filtering methods, tunnel overhead and mitigation architecture.
DDoS fundamentals
Packet Rate vs Bandwidth
Packet-processing limits can be reached before link bandwidth is exhausted. High-PPS attacks can therefore disrupt a service without saturating the uplink.
SYN Flood
A SYN flood abuses the TCP handshake by creating large numbers of half-open connections until the target runs out of state, queue space or processing capacity.
UDP Amplification Attacks
UDP amplification attacks abuse third-party services to turn small spoofed requests into much larger responses directed at the victim.
Protocols and connections
TCP Handshake
The TCP handshake establishes a connection before data is exchanged. The three-way handshake is a common target of TCP-based DDoS attacks.
GRE MTU Overhead
GRE encapsulation reduces effective MTU. Incorrect MTU or MSS settings can cause fragmentation, retransmissions and failed application sessions.
Traffic filtering
Stateful vs Stateless Filtering
Stateful filtering tracks sessions and packet context. Stateless filtering evaluates packets independently. This distinction has a direct effect on capacity under DDoS load.
XDP DDoS Filtering
XDP processes packets early in the Linux receive path and can discard attack traffic before later kernel networking stages.
Scrubbing Center
A scrubbing center receives attack traffic, filters malicious packets, and forwards the remaining legitimate traffic to the destination.
BGP FlowSpec
BGP FlowSpec distributes traffic filtering rules through BGP so routers can apply drop or rate-limit actions across the network without manual per-device changes.