Denial-of-Service Attack: How It Works and What to Do

What Is a Denial-of-Service Attack

A denial-of-service attack, often written as DoS, aims to make a website, server, or network resource unavailable to its intended users. Attackers overwhelm the target with traffic, exhaust its resources, or exploit weaknesses so it slows down or crashes entirely. A single machine can launch a simple DoS, while a distributed version uses many compromised systems at once. The goal is not usually to steal data, but to disrupt service and cause downtime.

How DoS Attacks Work

A server can handle only so many requests at a time. When it receives more than it can process, queues fill up, connections time out, and legitimate users are locked out. Attackers use this bottleneck. In a basic DoS, one machine sends a flood of requests or malformed packets. In a distributed denial-of-service, or DDoS, traffic comes from many sources simultaneously, making it harder to block. Some attacks target specific parts of the application stack, such as the database or authentication layer, instead of raw network bandwidth.

Common Types of DoS Attacks

• Volumetric attacks — consume all available bandwidth with massive traffic floods, often using amplification techniques.
• Protocol attacks — exploit weaknesses in network protocols, such as SYN floods that tie up connection tables.
• Application-layer attacks — target specific services like HTTP requests, aiming to exhaust CPU or memory.
• Resource exhaustion attacks — force the system to use up RAM, disk space, or CPU until it stops responding.
• Slowloris and similar — hold many connections open for as long as possible without completing requests.

DoS vs DDoS: What Is the Difference

A DoS attack comes from a single source. A DDoS attack distributes the traffic across many machines, often a botnet of compromised devices. This makes DDoS harder to stop because blocking one IP address does little when thousands are involved. Both types aim for the same result — service disruption — but DDoS attacks are larger in scale and more common in practice.

Signs You Are Under a DoS Attack

Symptoms can appear suddenly. Websites become slow or stop loading. Server logs show spikes in traffic from unusual locations. Error rates climb, and legitimate users report timeouts. Network monitoring tools may show abnormally high bandwidth usage or repeated failed connection attempts. In some cases, the attack is subtle and targets a specific feature, making it harder to notice without close monitoring.

How to Mitigate a DoS Attack

Effective defense starts with preparation. Rate limiting controls how many requests a single user can make. Firewalls and intrusion prevention systems can filter known attack patterns. Content delivery networks absorb traffic across distributed nodes, reducing the load on the origin server. Blackholing and scrubbing services redirect malicious traffic away from the target. For application-layer threats, web application firewalls help identify and block suspicious requests before they reach the server.

Why DoS Attacks Happen

Motivations vary. Competitors may use disruption as a competitive tactic. Hacktivists may target organizations they disagree with. Extortion schemes demand payment to stop an ongoing attack. Sometimes DoS is a distraction while another breach occurs elsewhere. Understanding the motive helps organizations choose the right response and prioritize which protections to invest in.

What to Do During an Attack

If you suspect an active DoS attack, act quickly. Contact your hosting provider or DDoS mitigation service immediately. They can route traffic through filtering layers and absorb the flood. Communicate with users through alternate channels, such as social media or a status page, to set expectations. Preserve logs and traffic data for analysis after the event. Do not attempt to negotiate with attackers or pay ransom unless guided by law enforcement.

Recovery and Post-Incident Steps

Once traffic normalizes, review what happened. Identify which services were affected, how long the outage lasted, and what protections held. Update firewall rules, rate limits, and monitoring thresholds based on what the attackers tried. Patch any vulnerabilities that were exploited. Document the incident so the team is better prepared if it happens again. A post-incident review turns a disruptive event into a learning opportunity.

Key Takeaways

Denial-of-service attacks remain one of the most disruptive threats to online services. They do not always require sophisticated tools, but they do require preparation. With the right mix of monitoring, filtering, and response planning, organizations can reduce downtime and keep services available even under pressure.