DDoS comes up in two conversations that have little to do with each other. In one, a company's site is down and nobody can check out. In the other, someone in a game lobby is threatening to knock a stranger's home connection offline. Both are the same attack at very different scales, and neither involves anyone breaking in. That is the part most explanations bury: a denial-of-service attack does not read, copy or change anything. It makes something unreachable, and then it stops.
What Is a DDoS Attack?
The acronym unpacks into the definition. Denial of service is the goal: legitimate users are denied the service. Distributed is the method: traffic arrives from many places at once instead of one.
CISA states it in two sentences. A denial-of-service attack "occurs when legitimate users are unable to access information systems, devices, or other network resources due to the actions of a malicious cyber threat actor," and a distributed denial-of-service attack "occurs when multiple machines are operating together to attack one target."
So the target is availability, not confidentiality. A server can hold only so many connections open, carry only so much bandwidth, and do only so much processing per second. Consume all of any one of those and you have won without finding a flaw in the software. That makes it the strangest of the cyber security threats to defend: no dwell time to detect, no stolen credential to revoke, no notification letter afterward. There is an outage, and then there is not.
What Is the Difference Between DoS and DDoS?
One letter, one enormous practical difference. The joint guide from CISA, the FBI and MS-ISAC, Understanding and Responding to Distributed Denial-of-Service Attacks, draws the line: a DoS attack "involves a single source used to overwhelm the target system," typically one machine or a few, while a DDoS attack "involves multiple sources," usually a botnet hitting the target simultaneously.
The guide names two consequences. The first is volume, since "the main advantage of a DDoS attack over a DoS attack is the ability to generate a significantly higher volume of traffic." The second is defense: blocking one address is trivial, while blocking a hundred thousand spread across every country, many belonging to people whose devices were conscripted, is not. Attackers add IP spoofing on top to disguise where the traffic came from at all. So the practical question is whether a firewall rule can solve it. Against a single source, usually yes. Against a distributed one, almost never.
How Does a DDoS Attack Work?
Every DDoS attack has two halves: building the army, then pointing it. The building happens weeks or months earlier and has nothing to do with the eventual victim.
Devices get infected with malware that does nothing visible. Routers, security cameras, home storage boxes, set-top boxes and cheap smart appliances are the usual recruits, because they ship with default passwords, rarely get patched and stay powered on. Each one becomes a bot, collectively they are a botnet, and whoever controls the botnet issues one instruction to all of them at once.
- Devices are infectedRouters, cameras and set-top boxes with default passwords or unpatched firmware
- The botnet waitsNothing visible happens on the device. Owners have no idea it enrolled
- A target is chosenA website, an API, a game server, a DNS resolver or a whole network range
- One command goes outEvery bot starts sending traffic to the same address in the same second
- The target saturatesBandwidth, connection table or processing capacity runs out and real users are refused
- Traffic is filtered upstreamA provider with more capacity than the attack absorbs and drops it before it lands
The scale that reaches is worth holding on to. Cloudflare's 2025 Q4 DDoS threat report describes a botnet it calls Aisuru-Kimwolf, an estimated one to four million infected hosts, most of them Android TV devices in living rooms. From December 19, 2025 that botnet threw 902 attacks at Cloudflare and its customers, peaking at 205 million web requests per second. Every request came from a device whose owner was watching television.
Types of DDoS Attacks
The joint guide sorts every technique into three types and notes that "these categories are not mutually exclusive," because a serious attacker combines them. Each describes which finite resource is being consumed.
Volumetric attacks
These "aim to consume the available bandwidth or system resources of the target by overwhelming it with a massive volume of traffic." This is the brute-force category and the one that sets the records. The clever versions do not send the traffic themselves; they trick someone else into sending it, which MITRE ATT&CK catalogs as Reflection Amplification under Network Denial of Service, T1498.
MITRE notes the second effect of that forged address: it "reduces the effectiveness of source-based filtering," because the addresses flooding the victim belong to legitimate public servers with no involvement in the attack.
Protocol attacks
These "exploit vulnerabilities in network protocols or services," and the guide places them at layers 3 and 4 of the OSI model. They aim at state rather than bandwidth. A SYN flood opens thousands of half-finished connections and completes none of them, filling the connection table until no real visitor can start one. The traffic volume can be modest and the effect is the same.
Application layer attacks
These "target vulnerabilities in specific applications or services running on the target system," at layer 7. They are the cheapest to run and the hardest to filter, because every request looks like a person using the site. One request for a search results page costs the attacker almost nothing and costs the server a database query.
| Attack | Category | What it consumes | What stops it |
|---|---|---|---|
| UDP flood | Volumetric | Uplink bandwidth | Upstream filtering, rate limiting at the network edge |
| ICMP or ping flood | Volumetric | Uplink bandwidth | Rate limiting or dropping ICMP at the edge |
| DNS amplification | Volumetric | Uplink bandwidth | Upstream scrubbing; source networks blocking spoofed addresses |
| NTP and memcached amplification | Volumetric | Uplink bandwidth | The same, plus closing the reflectors themselves |
| SYN flood | Protocol | The server's connection table | SYN cookies, connection rate limits, a stateful scrubbing layer |
| ACK and fragmentation floods | Protocol | Firewall and load balancer state | Purpose-built mitigation hardware or a cloud scrubbing service |
| HTTP flood | Application | Application processing and database time | A web application firewall, request rate limiting, caching |
| Slowloris and low-and-slow | Application | Available worker threads or sockets | Connection timeouts, a reverse proxy that buffers requests |
| DNS query flood | Application | The authoritative DNS server | Anycast DNS with capacity far above the attack |
Multi-vector attacks combine several rows at once, which is normal at the top end. Cloudflare's report describes an 18-day campaign in the first quarter of 2025 that mixed SYN floods, Mirai botnet traffic and SSDP amplification against internet infrastructure.
What Can a DDoS Attack Do?
Within its lane, quite a lot. The joint guide lists the outcomes as service outages, financial losses and reputational damage. For anything that sells, books or streams, an hour of unreachability is an hour of nothing, plus a support queue and customers who try a competitor.
Outside its lane, less than people assume. It does not read your database, copy files or install anything. If your site was flooded and came back, the sequence in what to do after a data breach does not apply; the incidents in the recent data breaches section all involved data leaving, which is a different failure with a different aftermath.
One exception deserves weight. CISA's guidance tells defenders to "monitor other network assets" during an attack, because a flood makes excellent cover: alerts are firing, the team is fully occupied with an availability problem, and a quieter intrusion elsewhere goes unwatched.
Why Do People Launch DDoS Attacks?
Money is one motive but not the main one. The ones that actually turn up, roughly in the order a small organization meets them:
- Extortion. An email demanding cryptocurrency, sometimes with a short demonstration attack attached.
- Grudges. Gaming, streaming, forums and school networks. Small, cheap, personal, and by volume the most common.
- Hacktivism. A political grievance against a government site, a bank, an airline or a media outlet.
- Competitive sabotage. Retailers on launch day, betting sites during a fixture, exchanges during volatility.
- Cover. The distraction described above.
The extortion version is where people make expensive mistakes. It looks superficially like ransomware and behaves nothing like it.
How Long Do DDoS Attacks Usually Last?
Shorter than almost everyone expects. The largest attack ever publicly disclosed, which Cloudflare measured at 31.4 terabits per second, lasted 35 seconds. Most are over in minutes.
Two things follow. Any defense that needs a human to notice, log in and switch something on has already lost, because the attack finishes before the ticket is assigned; mitigation has to be automatic and always on. And duration is not damage, since 35 seconds at that scale saturates an uplink completely and kills every connection in progress. The long tail exists too, as the 18-day campaign above shows, but the short attack is the one you are far more likely to meet.
How to Know If You Are Under a DDoS Attack
CISA lists three symptoms anyone notices without tooling: "unusually slow network performance," "unavailability of a particular website," and "an inability to access any website." The joint guide adds what a defender with logs can see, including sudden network congestion, a spike in requests from particular addresses or aimed at one URL, servers crashing for no clear reason, sustained high CPU or memory use, and DNS or voice services failing alongside the website.
None of that is proof on its own, which is the trap.
Can You Stop a DDoS Attack?
Yes, but almost never from inside your own perimeter once it has started. If ten gigabits per second are arriving at a one gigabit connection, the connection is full before your equipment gets a vote, and a firewall rule drops packets that already consumed the bandwidth you were protecting. That is the structural fact: the defense has to sit somewhere with more capacity than the attack.
The layer that absorbs it goes by several names. A content delivery network sits in front of the origin and serves cached content from hundreds of locations, so a flood spreads across all of them instead of landing on one server. Anycast routing does the same by advertising one address from many data centers. A scrubbing service reroutes your traffic through filtering infrastructure and forwards only what looks legitimate. Behind that layer, a firewall and sensible rate limits still do real work on the application-layer requests that get through.
Is a DDoS Attack Illegal?
In the United States, yes, and the statute is not obscure. The FBI's announcement on booter and stresser services states that using one against a target without the owner's permission is punishable under the Computer Fraud and Abuse Act, 18 U.S.C. 1030, with consequences including seizure of devices, arrest, imprisonment and fines.
Two details catch people out. Paying for an attack is the same offense as launching one: these services market themselves as stress-testing tools, and the FBI notes they are advertised in forums and on dark web marketplaces and paid for through ordinary payment services and virtual currency. Buying five minutes against a game server is a federal crime, and these services keep customer records that get seized along with the domains.
The botnet side carries charges of its own. In the FBI's 2025 Internet Crime Report, botnet complaints rose to 715 from 587 the year before, with $13,859,049 in reported losses, and botnets made up 7 percent of the cyber threat complaints IC3 received. Read those as reporting levels rather than infection counts, since the owner of a conscripted camera has no reason to file anything.
How to Prevent DDoS Attacks
Prevention is two jobs: not being an easy target, and not being part of somebody else's botnet. The joint guide's preparation list runs to fifteen items written for government network defenders. Condensed to what a small organization can act on this week:
Key takeaways
- DDoS stands for distributed denial of service. It floods a target with traffic from many machines at once until real users cannot get through.
- It attacks availability, not data. Nothing is stolen, nothing is encrypted, and the outage ends when the traffic does.
- The traffic comes from a botnet of ordinary infected devices, and the largest one recently observed was built mostly from Android TV boxes.
- The three types are volumetric floods that eat bandwidth, protocol attacks that exhaust connection state, and application attacks that look like real visitors.
- Most attacks last minutes, so mitigation has to be automatic and always on rather than something a person switches on.
- A firewall cannot stop a volumetric attack, because the bandwidth is gone before the firewall sees the packets. Absorption happens upstream.
- Launching one, or paying a booter service to launch one, is a federal crime under the Computer Fraud and Abuse Act.
Common questions
What does DDoS stand for?
Distributed denial of service. Denial of service is the goal, making a system unavailable to the people who should be able to use it. Distributed is the method: traffic from many machines at once rather than from one.
What is a DDoS attack in simple terms?
Thousands of computers all try to load the same website in the same second, on purpose, until it runs out of capacity and stops answering anyone. They usually belong to ordinary people whose devices were infected without their knowledge.
What is the difference between DoS and DDoS?
A DoS attack comes from one source, a DDoS attack from many. Distribution lets an attacker generate far more traffic and makes the attack much harder to block, since there is no single address to filter and the sources are often forged.
Is a DDoS attack illegal?
Yes. In the United States it falls under the Computer Fraud and Abuse Act, 18 U.S.C. 1030, and the FBI states that using a booter or stresser service against a target without permission is punishable by seizure of devices, arrest, imprisonment and fines. Paying counts the same as launching.
What can a DDoS attack do?
Make a website, app, API, game server or whole network unreachable for as long as the flood continues, which costs revenue, support time and reputation. It cannot steal data by itself, though it is sometimes used as cover while something quieter happens elsewhere.
How long do DDoS attacks usually last?
Most last minutes, and the largest ever publicly disclosed ran for 35 seconds. Campaigns lasting days or weeks exist but are rare, which is why mitigation has to run automatically rather than being switched on by hand.
Can you stop a DDoS attack?
Yes, but usually not from your own equipment once it is underway. The defense has to sit upstream at a provider with more capacity than the attack, which is what a CDN, an Anycast network or a scrubbing service provides. Inside your perimeter, rate limit expensive routes and cache aggressively.
Does a DDoS attack steal your data?
No. It consumes capacity; it does not read files, copy databases or install anything. The caution worth keeping is that an attacker may use the noise as cover for a separate intrusion, so the rest of the network deserves closer attention during an attack.
Can someone DDoS you from your IP address?
A home connection can be flooded if someone knows its address, which is why this happens in gaming and streaming. It knocks the connection offline rather than compromising any device. Contact your ISP, restart the router to pick up a new address if yours is dynamic, and keep that address out of lobbies.
What is a botnet?
A network of internet-connected devices infected with malware that lets someone else control them remotely. Routers, cameras and set-top boxes are the usual recruits because they ship with default passwords and rarely get updated. One command sends every device at the same target at once.
On this page
- What Is a DDoS Attack?
- What Is the Difference Between DoS and DDoS?
- How Does a DDoS Attack Work?
- Types of DDoS Attacks
- What Can a DDoS Attack Do?
- Why Do People Launch DDoS Attacks?
- How Long Do DDoS Attacks Usually Last?
- How to Know If You Are Under a DDoS Attack
- Can You Stop a DDoS Attack?
- Is a DDoS Attack Illegal?
- How to Prevent DDoS Attacks
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.