What Happens During a DDoS Attack
A distributed denial-of-service attack overwhelms a target with traffic from many sources at once, making a website or online service slow or completely unavailable to legitimate users. The attacker uses a botnet — a network of compromised devices — to send more requests than the target can handle.
More from this site
Keep reading the latest coverage
How an Attack Unfolds
An attack typically moves through three phases: reconnaissance, where the attacker identifies targets and vulnerabilities; amplification, where they generate massive traffic volumes using techniques like DNS or UDP reflection; and the flood itself, where the target's resources are saturated. Traffic can target the network layer, the transport layer, or the application layer, each requiring different defenses.
What the Target Experiences
During an attack, legitimate users see slow page loads, timeouts, or complete outages. Server resources like CPU, memory, and bandwidth are consumed by malicious requests. Logs show unusual traffic spikes from many IP addresses, often across different geographies, and monitoring tools flag the anomaly.
Common Types of DDoS Attacks
- Volumetric attacks: Flood the bandwidth with UDP floods, ICMP floods, or amplification techniques.
- Protocol attacks: Exploit weaknesses in network protocols, such as SYN floods or Ping of Death.
- Application-layer attacks: Target specific services like HTTP requests to exhaust database connections or CPU.
How Organizations Respond
Defenses include traffic filtering, rate limiting, content delivery networks that absorb and disperse attack traffic, and blackholing — rerouting malicious traffic away from the origin. Cloud-based mitigation services can scale capacity on demand to absorb large attacks.
Why DDoS Attacks Persist
DDoS attacks remain common because botnets are widely accessible, the cost to the attacker is low, and the disruption can be severe. Organizations that invest in layered defenses, real-time monitoring, and incident response plans recover faster and reduce downtime.