What Is a DDoS Attack? Types, Examples and Defenses

What is a DDoS attack? It is an attempt to knock a website, application or network offline by flooding it with more traffic than it can handle, sent from many machines at once. Most attacks come from botnets of hijacked devices, and many are bought from illegal "booter" services. This guide explains how DDoS attacks work, the three main types, what record attacks show, why stressers are against the law, and how to prepare. It also covers how authorized DDoS resilience testing is run safely with your ISP and cloud provider.

What Is a DDoS Attack?

A distributed denial-of-service (DDoS) attack is a cyberattack that makes an online service unavailable by exhausting its bandwidth, connection capacity or computing resources with traffic from many sources at the same time. Legitimate users then cannot reach the service. A DDoS attack targets availability; it does not by itself steal or change data.

The CISA, FBI and MS-ISAC guide to DDoS attacks defines a denial-of-service attack as one that exhausts a target's resources so legitimate users are denied access. It becomes a DDoS attack when the traffic comes from more than one attacking machine working in concert. MITRE ATT&CK tracks the behavior as two techniques: Network Denial of Service (T1498), which floods bandwidth, and Endpoint Denial of Service (T1499), which exhausts a host or application.

DoS vs DDoS

A single-source DoS can still matter when it exploits a software flaw, such as a request that crashes a server. But the distributed version is what most people mean today, because spreading the attack across many sources makes it both larger and much harder to block.

How a DDoS Attack Works

Every DDoS attack has the same basic shape: many senders, one target, and a goal of exhausting something the target needs. What changes is where the traffic comes from and which resource it attacks.

1. The attacker gets traffic sources. They build or rent a botnet, a network of malware-infected devices that follow commands from a command-and-control (C2) server. Many attackers never build anything; they pay a booter service that already controls one.
2. The attacker picks a vector. Bots can send traffic straight at the target, or they can bounce it off third-party servers in a reflection attack.
3. The C2 server issues the command. Every bot starts sending at the same moment, and the traffic looks like it comes from everywhere at once.

Direct floods, reflection and amplification

In a direct flood, the bots send packets or requests to the target themselves. In a reflection attack, the attacker sends small queries to public servers, such as DNS resolvers or other UDP services, but forges the source address so the replies go to the victim. When the reply is much larger than the query, the attack is also an amplification attack. MITRE lists this as Reflection Amplification (T1498.002).

The 2018 attack on GitHub shows how strong amplification can be. According to GitHub's incident report, attackers abused memcached servers left open to the internet, a vector with an amplification factor of up to 51,000. Each byte the attacker sent could produce up to 51 KB aimed at GitHub.

Reflection depends on IP address spoofing, which is only possible because many networks still forward packets with forged source addresses. The long-standing fix is ingress filtering, published in 2000 as RFC 2827 (BCP 38), which tells networks to drop outbound packets whose source address does not belong to them.

Botnets: where the traffic comes from

Most DDoS traffic comes from devices whose owners have no idea they are taking part. Routers, IP cameras, digital video recorders and TV boxes are favorite targets because they are always online, rarely patched and often shipped with default passwords.

• Mirai (2016). CISA's alert on Mirai and other botnets reported that Mirai scanned for IoT devices using a short list of 62 common default usernames and passwords. Its source code was published at the end of September 2016, which let anyone build a copy. Mirai variants still drive large attacks today.
• Aisuru and Kimwolf (2024–2026). Cloudflare's 2025 Q4 DDoS threat report estimated the Aisuru-Kimwolf botnet at 1 to 4 million infected hosts, mainly Android TVs. On March 19, 2026, the U.S. Justice Department announced a court-authorized operation, run alongside actions in Canada and Germany, that disrupted the C2 infrastructure of Aisuru, KimWolf, JackSkid and Mossad. DOJ said the four botnets had hijacked more than three million devices worldwide and sold access under a "cybercrime as a service" model.

Taking down C2 servers does not clean the infected devices. They stay vulnerable until patched or replaced, which is why new botnets keep reusing the same device pool. For the scale of the IoT problem, see our IoT hacking statistics.

Types of DDoS Attacks

DDoS attacks fall into three broad types, the same categories CISA, the FBI and MS-ISAC use: volumetric, protocol and application-layer. They differ in what they exhaust, so the right defense differs too.

Volumetric attacks

Volumetric attacks try to fill the pipe. If a server sits behind a 10 Gbps link and receives 100 Gbps of junk, legitimate packets cannot get through, no matter how well the server itself is configured. These attacks are usually UDP floods or reflection and amplification attacks, and they are the ones that set size records. Because the bottleneck is upstream of you, the only real defense is capacity upstream: your ISP, a CDN or a cloud DDoS service that can absorb and filter the flood before it reaches your link.

Protocol attacks

Protocol attacks target the state that network devices keep. The classic case is the SYN flood. A TCP connection begins with a SYN packet, and the server holds a half-open connection while it waits for the client to finish the handshake. Flood the server with SYNs that never complete and its connection table fills up. The IETF's RFC 4987 on TCP SYN flooding documents the attack and mitigations such as SYN cookies, which let a server avoid storing state until the handshake completes. Firewalls and load balancers are often the first devices to fail, because they track state for everything behind them.

Application-layer (L7) attacks

Application-layer attacks send requests that look legitimate but are expensive to answer: search queries, login attempts, uncached pages or API calls that hit the database. They need far less bandwidth than volumetric floods, so they can slip past defenses that only watch traffic volume.

The largest documented example is HTTP/2 Rapid Reset. In August 2023, Google mitigated an attack peaking above 398 million requests per second, more than seven times its previous record. The technique abused HTTP/2 stream cancellation and is tracked as CVE-2023-44487, which NVD describes as exploited in the wild from August through October 2023. The lesson for defenders: some L7 attacks are fixed with a patch, not more bandwidth. Our web application security guide covers the application-side controls that also blunt L7 floods.

Multi-vector and ransom DDoS

Real attacks often combine types, for example a UDP flood to saturate the link while an HTTP flood hits the login page. Attackers also switch vectors mid-attack to see what gets through. Some send ransom notes demanding payment to stop or to avoid an attack. Others are political: almost 80% of the EU incidents in ENISA's 2025 threat landscape data were hacktivist DDoS campaigns, and some state-aligned groups pose as hacktivists. Our cyber warfare statistics put those numbers in context.

A DDoS attack can also be a distraction. The CISA, FBI and MS-ISAC guide warns that attackers may use a DDoS attack to divert attention from malware deployment or data theft, and tells victims to keep watching for other compromise during the response.

Record DDoS Attacks: What the Primary Sources Show

Record sizes are easy to misquote, so the table below uses only figures published by the organization that saw or mitigated the attack. For counts, trends and industry breakdowns, see our DDoS attack statistics, which tracks the numbers quarter by quarter.

Sources for the table: CISA's Mirai alert, the FBI IC3 public service announcement on booter services, GitHub's incident report, Google Cloud's Rapid Reset post and Cloudflare's 2025 Q4 report, which describes the 31.4 Tbps attack as the largest ever disclosed publicly.

Three lessons stand out:

• Size grows faster than most networks. The peak rose from about 1 Tbps in 2016 to 31.4 Tbps in 2025. Few organizations can absorb even a small fraction of that on their own links.
• Short attacks still cause outages. The record attack lasted 35 seconds, and GitHub was fully unavailable for about five minutes. Detection and mitigation must be automatic, not a manual ticket.
• Enforcement makes a difference, but does not end the threat. Cloudflare's 2026 Q3 report found that attacks above 1 Tbps fell to 251 in the third quarter from 805 in the second, coinciding with the action against Aisuru, KimWolf, JackSkid and Mossad. It also reported new IoT botnet variants appearing and a surge in short, low-bandwidth attacks typical of booter services.

Are Booters and Stressers Illegal?

A booter or stresser is a website that sells DDoS attacks as a service. A customer picks a target and a duration, pays, and the service launches the attack using a botnet or reflectors it controls. Many of these sites claim they are "stress testing" tools for checking your own network.

In the United States, using them against someone else is a federal crime. The FBI states plainly that participating in DDoS attacks and DDoS-for-hire services is illegal, and that booter and stresser services "have no legitimate use" (FBI). The FBI's IC3 public service announcement explains that launching an attack, whether with your own botnet or by hiring a booter, can be prosecuted under the Computer Fraud and Abuse Act (18 U.S.C. § 1030). Consequences listed include seizure of devices, arrest, prison and fines. Hiring someone else to do it is not a defense.

Law enforcement has acted on this repeatedly under Operation PowerOFF, an international effort against DDoS-for-hire services:

• December 2022: the Justice Department seized 48 booter domains and charged six men with operating DDoS-for-hire services, as reported by KrebsOnSecurity.
• March 19, 2026: DOJ, with partners in Canada and Germany, disrupted the C2 infrastructure of four IoT botnets that sold attack capacity to other criminals.
• April 16, 2026: DOJ's District of Alaska seized eight more DDoS-for-hire domains and said more than 11 defendants had been charged and more than 100 booter domains seized over the previous four years. Investigators also run search ads triggered by DDoS-related keywords to warn would-be customers.
• September 2026: the FBI seized domains of NightmareStresser, a long-running booter, according to The Hacker News.

How do you tell a stresser from a legitimate test?

If a service lets you attack a target without proving you own it, it is a booter, whatever it calls itself.

Signs You Are Under a DDoS Attack

Not every slowdown is an attack. A product launch, a viral post or a broken deployment can look similar. The CISA, FBI and MS-ISAC guide lists these common indicators:

• Network latency or unusually slow performance when opening files or loading sites
• Sluggish application performance
• High processor and memory use on servers
• Abnormally high network traffic
• Websites that become unavailable or unreachable

Patterns that point toward an attack rather than real demand include traffic from unusual countries or networks, a flood of one packet type or request path, many requests with identical or nonsensical headers, and a sharp spike that does not match marketing activity. If you see these, contact your ISP or DDoS provider first. CISA notes they can tell you whether the problem is an outage on their side, an attack on their network that affects you indirectly, or an attack aimed at you.

How to Prevent and Mitigate DDoS Attacks

You cannot stop someone from targeting you, so DDoS defense is about absorbing, filtering and recovering. The approach below follows the before, during and after structure of the CISA, FBI and MS-ISAC guide.

Before an attack

• Know what must stay up. List your internet-facing services, rank them by business impact, and record what each depends on: DNS, CDN, load balancers, identity providers and third-party APIs.
• Put absorption capacity upstream. Use a DDoS protection service, a CDN with DDoS mitigation, or your ISP's scrubbing service. MITRE's mitigation guidance for network floods is the same: when floods exceed your link, the traffic has to be filtered upstream by the ISP, a CDN or a DDoS specialist.
• Read your provider agreements. Check what is covered, what triggers mitigation, whether it is always-on or on-demand, and how fast the provider commits to act.
• Hide and lock down origin servers. If a CDN protects your site, accept traffic at the origin only from the CDN's addresses. An exposed origin IP lets attackers go around the protection.
• Harden protocols and applications. Enable SYN cookies, tune connection limits, cache what you can, rate-limit expensive endpoints such as login and search, and patch known DoS flaws such as CVE-2023-44487.
• Remove amplification sources you own. Close open resolvers and unneeded UDP services, and apply BCP 38 source-address filtering on networks you run, so your infrastructure cannot be used against others.
• Write a DDoS response plan. CISA recommends a plan that covers confirming an attack, deploying mitigations, monitoring and recovery, with roles for leadership, network defenders and service providers. Fold it into your incident response plan.
• Rehearse it. CISA also recommends DDoS tabletop exercises with internal and external stakeholders, followed by an after-action review. Our cybersecurity tabletop exercise guide shows how to structure one.

During an attack

• Confirm it. Check provider dashboards, flow data and server metrics to tell an attack from an outage or a traffic spike.
• Call your ISP and DDoS provider. Use the contacts in your plan, share what you see, and switch on-demand protection if it is not always-on.
• Apply targeted filters. Block the specific protocol, port, path or pattern being abused, and rate-limit rather than shut off entire regions unless the business accepts the cost.
• Keep watching everything else. Treat the DDoS as a possible cover for intrusion and keep normal security monitoring running.
• Communicate and document. Tell customers what is affected, log timestamps and actions, and report the attack to the FBI through its field office or IC3.

After an attack

• Run an after-action review with every team and provider involved.
• Measure time to detect, time to mitigate and what still got through.
• Update filters, provider settings and the response plan, then test the changes.

DDoS readiness checklist

How DDoS Resilience Testing Is Done Safely

Protection that has never been tested is an assumption. A DDoS resilience test sends controlled, authorized traffic at your own services to confirm that detection, mitigation and your team's runbook work as expected. Done properly, it is a coordinated exercise with your providers, not a surprise attack on your own infrastructure.

Step 1: Authorize and scope

The asset owner signs off in writing on the exact targets (IP addresses and hostnames), the attack types to simulate, the maximum rates, the dates and the people who can stop the test. Nothing outside that scope is touched, and shared infrastructure that serves other customers needs extra care.

Step 2: Coordinate with your ISP and cloud providers

Traffic in a DDoS test crosses networks you do not own. Upstream providers must know about it in advance, both to avoid harming their other customers and so their own defenses do not treat the test as a real attack. Cloud providers publish specific rules:

The full terms are in the AWS DDoS simulation testing policy and Microsoft's Azure DDoS Protection simulation guide. Other hosting providers have their own rules, so check before you schedule anything.

Step 3: Plan the test window

Choose a staging environment or off-peak hours, set up a bridge call with your team, the tester and provider contacts, and agree abort criteria. Any unexpected impact on production users or third parties ends the test immediately through a kill switch the tester controls.

Step 4: Ramp up gradually

A safe test starts well below the expected mitigation threshold and raises the rate in steps, one vector at a time. That shows where mitigation engages and whether anything degrades before it does. It also limits harm if a control fails.

Step 5: Measure, report and retest

The value of a test is in what you measure:

• Time until the attack was detected, and by whom
• Time until mitigation engaged, and whether it was automatic
• How much test traffic reached the origin, and which services degraded
• Whether alerts reached the right people and the runbook was followed
• Which provider settings, rules or contacts needed changes

Fix the gaps, then retest. Not every check needs high traffic. Reviewing provider settings, origin exposure, rate-limit rules and the runbook finds many problems without sending any load. Those checks fit well alongside a network penetration test, which looks at the same perimeter from an intrusion point of view.

What a safe test never includes: booter or stresser services, reflection through third-party servers, targets you do not own or control, or traffic your providers have not been told about.

Frequently Asked Questions

Is a DDoS attack illegal?

Yes. In the United States, launching a DDoS attack against systems you do not own, or paying a booter or stresser service to do it, can be prosecuted under the Computer Fraud and Abuse Act. The FBI says DDoS-for-hire services have no legitimate use. Testing your own systems is lawful when it is authorized and follows your providers' terms.

How long does a DDoS attack last?

Most are short. Cloudflare reported that 96% of network-layer attacks it mitigated in the third quarter of 2026 ended in under 10 minutes, and the record 31.4 Tbps attack lasted 35 seconds. Campaigns can still run for hours or days, with repeated bursts. Our DDoS statistics page tracks duration trends.

How do I know if I am under a DDoS attack?

Look for sudden slowness or unavailability together with abnormal traffic, high CPU or memory use, and floods of one packet type, path or source pattern that do not match real customer activity. Contact your ISP or DDoS provider to confirm whether the traffic is an attack aimed at you.

Can a DDoS attack be traced?

Sometimes, but rarely quickly. Traffic comes from hijacked devices or spoofed addresses, so the visible sources are victims, not the attacker. Law enforcement traces operators through C2 servers, payments and booter-site records, which is how Operation PowerOFF identifies administrators and customers.

What is the difference between DoS and DDoS?

A DoS attack comes from one source, so blocking that source often stops it. A DDoS attack comes from many sources at once, usually a botnet or reflectors, which makes it larger and much harder to filter.

Can a DDoS attack steal data?

Not on its own. It attacks availability, not confidentiality. But CISA warns that attackers can use a DDoS attack as a distraction while they install malware or steal data, so keep monitoring for intrusion during any attack.

Can a firewall stop a DDoS attack?

Only small ones. A firewall cannot help if the flood fills the link in front of it, and stateful firewalls can themselves be overwhelmed by protocol attacks. Large attacks must be absorbed upstream by your ISP, a CDN or a DDoS protection service.

Next Step: Test Your DDoS Readiness

DDoS protection usually fails in the gaps: an exposed origin server, an on-demand service nobody switches on, a rate limit that was never set, or a runbook without current provider contacts. The checks that matter are concrete. Confirm what is protected, how fast mitigation engages, and whether your team and providers act as planned.

DeepStrike can run authorized DDoS resilience testing, coordinated with your ISP and cloud providers. Our penetration testing services also cover infrastructure, cloud and red team engagements carried out manually, with clear reports and actionable fix recommendations. To discuss scope, contact DeepStrike.

About The Author

Mohammed Khalil is a Cybersecurity Architect at DeepStrike, specializing in advanced penetration testing and offensive security operations. With certifications including CISSP, OSCP, and OSWE, he has led numerous red team engagements, focusing on cloud security, application vulnerabilities, and adversary emulation. His work involves dissecting complex attack chains and developing resilient defense strategies for clients in the finance, healthcare, and technology sectors.

Sources and References

CISA, FBI and MS-ISAC: Understanding and Responding to Distributed Denial-of-Service Attacks (updated March 21, 2024)

CISA: Heightened DDoS Threat Posed by Mirai and Other Botnets

MITRE ATT&CK: Network Denial of Service (T1498)

MITRE ATT&CK: Endpoint Denial of Service (T1499)

RFC 2827 (BCP 38): Network Ingress Filtering

RFC 4987: TCP SYN Flooding Attacks and Common Mitigations

Cloudflare: 2025 Q4 DDoS Threat Report

Cloudflare: DDoS Threat Report 2026 Q3

Google Cloud: Google mitigated the largest DDoS attack to date, peaking above 398 million rps

NVD: CVE-2023-44487

GitHub: February 28th DDoS Incident Report

FBI: The FBI and International Law Enforcement Partners Intensify Efforts to Combat Illegal DDoS Attacks

FBI IC3: Booter and Stresser Services Increase the Scale and Frequency of DDoS Attacks

U.S. Department of Justice: Authorities disrupt world's largest IoT DDoS botnets (March 19, 2026)

U.S. Department of Justice: U.S. authorities conduct cyber operations as part of global crackdown on DDoS-for-hire services (April 16, 2026)

KrebsOnSecurity: Six Charged in Mass Takedown of DDoS-for-Hire Sites

The Hacker News: U.S. Seizes NightmareStresser Domains

AWS: DDoS Simulation Testing Policy

Microsoft Learn: Azure DDoS Protection simulation testing