What is a DDoS Attack

Core idea

DDoS stands for distributed denial of service. The attack exhausts resources until legitimate traffic can no longer be processed normally.

Traffic commonly originates from many sources simultaneously, which limits the effectiveness of blocking individual source addresses.

Main attack categories

• Volumetric attacks try to saturate links with raw traffic volume
• Protocol attacks target packet processing or connection state
• Application attacks target specific services such as HTTP or DNS
• Reflection and amplification attacks use third-party systems to increase traffic toward the victim

Affected resources

A service does not need to lose all available bandwidth to fail. In many cases the real bottleneck is packet rate, connection tracking, CPU time, firewall state, load balancer capacity or application-level processing.

That is why a smaller attack in Gbps can still be very disruptive if packet size is small and the system has to process a large number of packets per second.

Mitigation constraints

Mitigation must remove attack traffic while preserving legitimate traffic.

Effective mitigation depends on where filtering happens, how much state is required, how fast rules can be distributed and whether the mitigation path can keep up with packet rate under load.