Distributed denial-of-service attacks can make websites, applications, networks, and digital services unavailable by overwhelming them with malicious traffic or resource-intensive requests.
Unlike a traditional denial-of-service attack originating from one source, a distributed attack uses multiple compromised devices or systems to target the same service simultaneously. These devices may form a botnet containing computers, servers, routers, cameras, and other internet-connected equipment.
Understanding the types of DDoS attacks helps organizations recognize how attackers consume bandwidth, exploit network protocols, overload applications, and disrupt essential services.
What Is a DDoS Attack?
A distributed denial-of-service attack attempts to prevent legitimate users from accessing a system, network, website, or application.
Attackers may achieve this by:
- Consuming the target’s available bandwidth
- Exhausting server resources
- Overloading network equipment
- Exploiting weaknesses in communication protocols
- Sending excessive application requests
- Creating large numbers of incomplete connections
- Targeting critical dependencies such as DNS services
The traffic originates from numerous sources, making it difficult to block using a single address or simple firewall rule.
DDoS attacks may target:
- Public websites
- Customer portals
- Mobile application interfaces
- Online banking platforms
- E-commerce services
- Government services
- Cloud applications
- Gaming platforms
- Telecommunications networks
- Domain Name System infrastructure
- Application programming interfaces
The objective may be operational disruption, financial loss, extortion, reputational damage, activism, distraction from another attack, or competitive sabotage.
The Main Types of DDoS Attacks
DDoS attacks are generally divided into three broad categories:
- Volumetric attacks
- Protocol attacks
- Application-layer attacks
Attackers may also combine several techniques in a multi-vector campaign. CISA similarly distinguishes volumetric, protocol, and application-layer DDoS techniques.
1. Volumetric DDoS Attacks
Volumetric attacks attempt to consume all available bandwidth between the targeted service and the internet.
Attackers generate extremely large quantities of traffic that prevent legitimate requests from reaching the organization’s systems.
These attacks are commonly measured in:
- Bits per second
- Gigabits per second
- Terabits per second
- Packets per second
The targeted server may remain technically operational, but the surrounding network becomes too congested to serve legitimate users.
UDP Floods
A User Datagram Protocol flood sends large volumes of UDP packets to different ports on the target.
The target may attempt to:
- Check whether an application is listening on each port.
- Determine that no application is available.
- Generate a response indicating that the destination is unreachable.
Repeating this process at scale can consume bandwidth and processing resources.
Because UDP does not require a complete connection before sending data, attackers can generate large volumes of traffic quickly.
ICMP Floods
An Internet Control Message Protocol flood overwhelms a target with diagnostic messages, such as echo requests commonly associated with the ping command.
The target consumes resources receiving and responding to the requests. When distributed across many attacking devices, the traffic can degrade connectivity or make the service unavailable.
Reflection Attacks
In a reflection attack, the attacker sends requests to external servers while replacing the original source address with the address of the intended victim.
The external servers then send their responses to the victim.
This method has two advantages for the attacker:
- It hides the direct origin of the malicious traffic.
- It recruits legitimate external systems into the attack.
The victim receives traffic from numerous apparently legitimate servers, making filtering more difficult.
Amplification Attacks
Amplification occurs when a small request generates a much larger response.
Attackers combine amplification with source-address spoofing so that large responses are delivered to the victim rather than the attacker.
The Internet Engineering Task Force describes DNS reflection as an example in which requests carrying the victim’s spoofed address generate responses directed toward that victim.
Common amplification techniques may misuse:
- Domain Name System services
- Network Time Protocol services
- Connectionless Lightweight Directory Access Protocol services
- Simple Service Discovery Protocol services
- Memcached servers
- Other exposed UDP-based services
The amplification factor represents how much larger the response is than the original request.
2. Protocol DDoS Attacks
Protocol attacks exploit how network and transport protocols establish, maintain, or terminate connections.
Instead of consuming only bandwidth, these attacks exhaust the processing capacity or connection tables of:
- Firewalls
- Load balancers
- Routers
- Servers
- Intrusion-prevention systems
- Other network appliances
Protocol attacks are commonly measured in packets per second.
SYN Floods
A SYN flood exploits the process used to establish a Transmission Control Protocol connection.
A legitimate connection normally follows three steps:
- The client sends a synchronization request.
- The server acknowledges the request.
- The client confirms the connection.
In a SYN flood, the attacker sends numerous initial requests but does not complete the final step.
The server keeps these incomplete connections open while waiting for confirmation. Eventually, its connection table or available resources may become exhausted, preventing legitimate users from connecting.
ACK Floods
An acknowledgment flood sends large quantities of ACK packets to the target.
Network devices must inspect the traffic to determine whether each packet belongs to a legitimate connection. Sufficient volume may overload firewalls, servers, or other stateful network equipment.
TCP Connection Floods
Attackers may establish many complete TCP connections and keep them active.
Although the connections appear technically valid, their volume consumes:
- Memory
- Processing capacity
- Available sockets
- Connection-table space
This can prevent legitimate users from establishing new sessions.
Fragmentation Attacks
Fragmentation attacks send incomplete, overlapping, or malformed packet fragments.
The target must attempt to reconstruct the original packets. Carefully crafted fragments may consume processing resources, create instability, or exploit weaknesses in how systems handle fragmented traffic.
Ping of Death
A Ping of Death attack uses malformed or oversized packets that exceed expected limits after being reassembled.
Modern systems are generally better protected against this technique, but outdated or improperly configured equipment may remain vulnerable.
Smurf Attacks
A Smurf attack sends spoofed ICMP requests to a broadcast network. The request uses the victim’s address as its source.
Multiple devices respond to the victim simultaneously, amplifying the traffic. Network configuration improvements have made traditional Smurf attacks less common, but the technique remains a useful example of reflection and amplification.
3. Application-Layer DDoS Attacks
Application-layer attacks target services operating at Layer 7, such as websites, applications, interfaces, and authentication platforms.
Instead of generating obviously abnormal network traffic, attackers send requests that resemble legitimate user activity.
These attacks may require less traffic than volumetric attacks because each request forces the application to perform expensive work.
Application-layer attacks are commonly measured in requests per second.
HTTP GET Floods
An HTTP GET flood sends large numbers of requests for webpages, images, documents, or other resources.
The targeted application must process each request and retrieve the requested content. When requests are distributed across many devices and resemble normal browsing behavior, distinguishing malicious users from real visitors becomes difficult.
HTTP POST Floods
An HTTP POST flood sends repeated requests that require the application to accept or process submitted information.
These requests may target:
- Login forms
- Contact forms
- Search functions
- File uploads
- Shopping carts
- Payment workflows
- Account registration
- Database-driven services
POST requests may consume more resources than simple page requests because they can trigger validation, database queries, authentication, or other backend processing.
Slowloris Attacks
A Slowloris attack opens many connections to a web server and keeps them active by sending incomplete requests very slowly.
The attacker uses relatively little bandwidth, but the server continues reserving resources for connections that never finish.
Eventually, legitimate users may be unable to establish new connections.
Slow POST Attacks
A slow POST attack begins submitting data but sends it at an extremely low rate.
The server keeps the connection open while waiting for the complete request. Large numbers of these connections can exhaust the available connection pool.
Cache-Busting Attacks
Content delivery networks and caching systems improve performance by storing frequently requested content.
In a cache-busting attack, the attacker modifies each request slightly so the requested resource does not appear in the cache. Every request must therefore reach the origin server.
This removes the protection normally provided by caching and places greater pressure on the application’s infrastructure.
Computationally Expensive Requests
Attackers may repeatedly call application functions that require significant processing.
Examples include:
- Complex database searches
- Large report generation
- Password-reset requests
- Image or document processing
- Dynamic pricing calculations
- Resource-intensive application interfaces
The traffic volume may appear moderate, but each request consumes substantial backend resources.
HTTP/2 Rapid Reset Attacks
HTTP/2 allows multiple request streams to operate through one connection. The Rapid Reset technique repeatedly creates and cancels streams at high speed, forcing servers to perform work while the attacker quickly resets the requests.
This technique demonstrated how application-layer attacks can achieve enormous request rates without following traditional traffic patterns. CISA issued guidance on the related HTTP/2 vulnerability in October 2023.
4. Reflection and Amplification Attacks
Reflection and amplification are often classified as volumetric techniques, but understanding them separately is useful because they describe how attackers generate and redirect traffic.
A reflection attack redirects responses from third-party systems toward the victim.
An amplification attack produces responses significantly larger than the attacker’s initial requests.
When combined, attackers can generate substantial traffic while using comparatively limited resources.
Organizations can unintentionally contribute to these attacks if they operate publicly accessible services that:
- Accept requests from any source
- Use connectionless protocols
- Generate responses larger than requests
- Do not validate source addresses
- Are configured as open resolvers or reflectors
Preventing systems from being abused as amplifiers is an important part of wider internet security.
5. Multi-Vector DDoS Attacks
Attackers do not always rely on one technique. They may combine several types of DDoS attacks or change their methods during an active incident.
For example, an attacker may:
- Begin with a large UDP flood.
- Launch a SYN flood against network equipment.
- Target the website with HTTP requests.
- Shift traffic between services to avoid filtering.
- Attack DNS or another external dependency.
A defense that successfully blocks one vector may not stop the others.
Multi-vector attacks require protection across the network, transport, and application layers.
Why Do Attackers Launch DDoS Attacks?
Operational Disruption The attacker may want to make a service unavailable and interrupt the organization’s activities.
Extortion Attackers may threaten to launch or continue an attack unless the organization pays them.
Activism Hacktivist groups may target organizations, governments, or services to promote political or social objectives.
Competitive Sabotage An attacker may attempt to disrupt a competitor during an important sale, event, product launch, or high-demand period.
Distraction A DDoS attack may distract security teams while attackers attempt another activity, such as:
- Accessing sensitive systems
- Extracting information
- Committing payment fraud
- Installing malware
- Compromising user accounts
Organizations should not assume service disruption is the only objective.
Revenge or Personal Motivation Disgruntled individuals, former employees, customers, or online groups may launch attacks to damage an organization.
Testing Defenses Threat actors may conduct a smaller attack to measure the target’s response before launching a larger campaign.
How DDoS Attacks Affect Organizations
A successful DDoS attack can cause:
- Website and application outages
- Slow service performance
- Failed transactions
- Interrupted customer access
- Lost revenue
- Increased infrastructure costs
- Breach of service-level commitments
- Customer dissatisfaction
- Reputational damage
- Pressure on technical teams
- Disruption of connected services
The impact may continue after the attack ends because teams must investigate the incident, restore systems, address customer concerns, and review defensive measures.
Warning Signs of a DDoS Attack
Common indicators include:
- Sudden increases in network traffic
- Large numbers of requests from unusual locations
- Unexpected traffic to one service or port
- Rapid growth in incomplete connections
- High processor or memory utilization
- Slow application response
- Increased error rates
- Large numbers of repeated requests
- Unusual traffic at unexpected times
- Website or service unavailability
- Unexpected increases in cloud consumption costs
One indicator alone does not always confirm an attack. Monitoring tools should compare activity against normal traffic patterns and consider several signals together.
How Organizations Can Reduce DDoS Risk
Establish Normal Traffic Baselines Organizations should understand normal traffic volume, request rates, geographic sources, protocol usage, and seasonal demand. Without a baseline, distinguishing an attack from legitimate growth can be difficult.
Use Distributed Infrastructure Distributing services across several servers, locations, or cloud regions makes it more difficult for one attack to overwhelm the complete environment.
Implement Load Balancing Load balancers distribute incoming traffic across available systems. They can help prevent one server from becoming overloaded and support the removal of unhealthy systems.
Use Content Delivery Networks Content delivery networks serve cached content from distributed locations, reducing traffic to the origin server and absorbing some malicious requests.
Deploy DDoS Mitigation Services Specialized mitigation providers can:
- Analyze incoming traffic
- Detect attack patterns
- Filter malicious packets
- Absorb high traffic volumes
- Scrub traffic before forwarding legitimate requests
- Provide emergency response support
Cloud providers may also include automatic protection against common network and transport-layer attacks.
Protect Applications With a Web Application Firewall A web application firewall can inspect HTTP requests and apply rules based on:
- Request rates
- Source locations
- User behavior
- Headers
- Known attack patterns
- Requested resources
- Authentication status
It is particularly useful against application-layer attacks.
Apply Rate Limiting Rate limiting restricts how many requests a user, address, account, or session can make within a defined period. Limits should be carefully configured so legitimate users are not blocked during normal traffic spikes.
Protect Domain Name System Services Organizations should use resilient, distributed DNS infrastructure.
DNS protection may include:
- Multiple authoritative servers
- Geographical distribution
- Anycast routing
- Monitoring
- Restricted administrative access
- DNS security controls
- A tested provider-failure plan
Segment Critical Services Public systems should be separated from internal and critical environments. A DDoS attack against a public website should not automatically affect administrative systems, databases, or internal operations.
Monitor Multiple Layers Detection should cover:
- Network traffic
- Transport connections
- Web requests
- Application performance
- Server resources
- DNS activity
- Cloud consumption
- User behavior
Different attacks produce different indicators.
Coordinate With Service Providers Internet service providers, hosting companies, cloud providers, and mitigation providers may need to take action during a large incident. Contact details, escalation procedures, and service responsibilities should be documented before an attack occurs.
Developing a DDoS Response Plan
A response plan should define:
- How suspected attacks are identified.
- Who declares a DDoS incident.
- Which internal teams must be contacted.
- How external providers are engaged.
- Which services receive priority.
- When mitigation controls are activated.
- How customers and stakeholders are informed.
- How evidence and traffic data are preserved.
- How systems are restored and validated.
- How the incident is reviewed afterward.
Organizations should test the plan through tabletop exercises and controlled simulations.
The team should understand the types of DDoS attacks it may face and know which mitigation measures apply to each one.
Common DDoS Protection Mistakes
Relying Only on a Firewall Traditional firewalls may become overwhelmed before they can filter large volumes of traffic. Protection should occur upstream and across several layers.
Blocking Individual Addresses Because attacks may involve thousands of compromised devices or reflected traffic, blocking addresses individually is rarely sufficient.
Ignoring Application-Layer Traffic An organization may have enough bandwidth to withstand a volumetric attack but remain vulnerable to carefully designed application requests.
Waiting Until an Attack to Contact Providers Emergency contact details and escalation procedures should be confirmed in advance.
Confusing Legitimate Demand With an Attack Product launches, major events, seasonal demand, and viral content can create unexpected traffic. Monitoring should combine traffic volume with behavioral and technical indicators.
Failing to Protect Dependencies A well-protected application may still become unavailable if attackers disrupt its DNS provider, authentication service, payment platform, or interface dependency.
A Practical DDoS Protection Roadmap
Organizations can improve their resilience through six stages:
- Identify: Document public services, infrastructure, dependencies, providers, and acceptable downtime.
- Assess: Review bandwidth, architecture, application behavior, DNS resilience, monitoring, and existing protections.
- Prioritize: Focus on services whose disruption would create the greatest operational, financial, or reputational impact.
- Protect: Implement distributed infrastructure, rate limiting, filtering, caching, web application firewalls, and managed mitigation.
- Prepare: Establish response procedures, provider contacts, communication plans, and recovery priorities.
- Test and improve: Conduct exercises, analyze incidents, tune controls, and reassess the evolving types of DDoS attacks.
How Advance DataSec Supports DDoS Resilience
Advance DataSec helps organizations evaluate and strengthen the security and availability of their public-facing systems and networks.
Our capabilities include:
- Network and security architecture reviews
- Vulnerability assessment and penetration testing
- Application and interface security testing
- Firewall and web application firewall solutions
- Network detection and response
- Security information and event management
- Cloud security assessments
- Configuration reviews
- Incident response readiness
- Business continuity and recovery planning
- Red team assessments
- Cybersecurity governance, risk, and compliance
Our approach helps organizations identify exposure, validate protection, improve monitoring, and prepare for disruptive cyber incidents.
Conclusion
DDoS attacks can target bandwidth, network protocols, server resources, applications, and critical service dependencies. Some generate enormous traffic volumes, while others use a smaller number of requests designed to consume significant processing capacity.
Understanding the types of DDoS attacks allows organizations to select appropriate protections for each layer of their environment.
Effective defense requires distributed infrastructure, continuous monitoring, resilient DNS, rate limiting, application protection, managed mitigation, provider coordination, and a tested response plan.
No single security control can stop every DDoS technique. Organizations need layered protection capable of detecting attacks early, absorbing malicious traffic, preserving essential services, and supporting rapid recovery.
Contact Advance DataSec to assess your exposure to DDoS attacks and develop a practical roadmap for stronger network, application, and service resilience.
Frequently Asked Questions
What is a DDoS attack?
A DDoS attack uses multiple devices or systems to send malicious traffic or requests toward one target, preventing legitimate users from accessing it.
What are the three primary DDoS categories?
The main categories are volumetric attacks, protocol attacks, and application-layer attacks.
What is the difference between DoS and DDoS?
A DoS attack typically originates from one source, while a DDoS attack uses multiple distributed sources.
What is a DDoS amplification attack?
It uses small requests that generate much larger responses, which are redirected toward the victim using a spoofed source address.
How can organizations prepare for DDoS attacks?
They should identify critical services, establish traffic baselines, deploy layered protection, coordinate with providers, create response procedures, and regularly test their readiness.
