DDoS Definition
What is a DDoS attack?
A distributed denial-of-service (DDoS) attack is an attempt to make a server, network, or online service unavailable by overwhelming it with more traffic than it can handle. The attack doesn’t come from one place. It comes from hundreds or thousands of compromised devices working in coordination, which is exactly what makes it hard to block.
The goal isn’t to steal data. It’s to cut access. Your website goes down. Your application stops responding. Your team can’t log in. And whoever is on the other side either wants to extort you, hurt your reputation, or create a distraction while something else happens in your environment.
DDoS attacks are not rare events reserved for governments or major corporations. According to Cloudflare’s 2025 DDoS Threat Report, hyper-volumetric attacks surpassed 5.6 terabits per second in late 2024.
The frequency of large-scale attacks targeting SMBs is increasing year over year. If your business depends on uptime, you need to understand how these attacks work and what stops them.
How a DDoS Attack Actually Works
The “distributed" part is the key word. A standard denial-of-service attack comes from a single IP address. Block that address and the attack stops. A distributed attack doesn’t give you that option.
Attackers build what’s called a botnet: a network of infected machines, often without their owners’ knowledge. These could be home routers, internet-connected printers, laptops with unpatched vulnerabilities, or IoT devices running outdated firmware. When the attacker sends the command, every device in the botnet starts sending traffic to the target simultaneously.
The target server tries to respond to every incoming request. Its connection table fills up. CPU and memory spike. Legitimate users start seeing slow load times, then timeouts, then nothing. The server isn’t hacked. It’s just exhausted.
Most DDoS attacks involve three layers of actors. First, the attacker issues commands. Second, command-and-control (C2) servers relay those commands, and finally, the botnet devices do the actual work. This separation makes attribution difficult and takedown efforts slow. By the time an attack is traced back, the botnet nodes have often already scattered.
Types of DDoS Attacks
Not all DDoS attacks hit the same target or use the same method. Understanding the category tells you what kind of mitigation actually helps.
Volumetric Attacks
These are the flood attacks. The goal is to saturate bandwidth by sending enormous amounts of data. UDP floods, ICMP floods, and DNS amplification attacks all fall into this bucket.
DNS amplification is worth understanding specifically. The attacker spoofs the victim’s IP address and sends small DNS queries to open resolvers. Those resolvers send large responses, but they go to the victim, not the attacker.
The ratio can be 50:1 or higher, meaning a relatively modest attack generates massive incoming traffic at the target. According to CISA’s infrastructure security advisories, amplification factors in some NTP-based attacks have reached 556:1.
Protocol Attacks
These exploit weaknesses in network protocols rather than raw bandwidth. The most common is the SYN flood.
Normal TCP connections involve a three-way handshake: SYN, SYN-ACK, ACK. A SYN flood sends thousands of SYN packets but never completes the handshake. The server holds each half-open connection in memory waiting for the final ACK that never comes. Eventually, the connection table fills and the server can’t accept legitimate connections.
What this means: Protocol attacks can crash a server with surprisingly little traffic. Volume isn’t the threat. Resource exhaustion is.
Application Layer Attacks (Layer 7)
These are the hardest to detect. Instead of raw packets, the attacker sends legitimate-looking HTTP requests, each of which requires the server to do real work: query a database, render a page, return search results.
The HTTP flood is a common example. Individually, each request looks normal. Collectively, they overload the web server and application stack. Because the traffic resembles real user behavior, basic IP-blocking and rate limiting are less effective.
Slowloris attacks take this further. They open many simultaneous connections to the target and send partial HTTP request headers very slowly, keeping each connection open without completing it. The server’s connection pool fills up. Real users can’t get through.
What DDoS Attackers Actually Want
The motivation determines the type of attack and, often, the target selection. Understanding intent helps you assess your own risk profile.
Ransom. Attackers launch a brief DDoS attack as proof of capability, then demand payment to stop a larger one. According to Radware’s 2024 Global Threat Analysis Report, ransom DDoS (RDoS) campaigns increased by 37% in 2024, with finance, e-commerce, and logistics as primary targets.
Competitive disruption. Less common, harder to prove, but documented: competitors or hostile actors targeting a business during a high-traffic period, like a product launch or major promotion.
Ideological or political motivation. Hacktivists use DDoS attacks against organizations they oppose. Government agencies, media outlets, and organizations involved in controversial topics see this type of attack more frequently.
Cover for another attack. This is the threat that keeps security teams up at night. A high-volume DDoS attack draws attention, consumes incident response capacity, and gives an attacker operating room to conduct a separate intrusion. The DDoS is the distraction. The actual breach happens somewhere quieter while your team is watching the traffic spike.
Who Is Typically Targeted in DDoS Attack
Any organization with a public-facing IP address is a potential target. Risk level scales with profile, industry, and infrastructure exposure.
Here’s the table in markdown:
| Business Profile | Risk Level | Primary Attack Vector |
| E-commerce (high traffic events) | High | HTTP floods during peak periods |
| Financial services and fintech | High | Ransom DDoS, protocol attacks |
| Online gaming platforms | High | UDP floods, direct player targeting |
| Healthcare (patient portal, telehealth) | Medium-High | Application layer attacks |
| MSPs managing multiple client networks | Medium-High | Amplification attacks targeting upstream infrastructure |
| SMBs with on-premise servers | Medium | Volumetric attacks exploiting limited bandwidth |
| Internal enterprise tools (no public IP) | Lower | Less exposed, but not immune |
SMBs with on-premise infrastructure face a specific problem. They have limited bandwidth and no upstream traffic scrubbing. A volumetric attack that a cloud provider’s network would absorb without blinking can take down a small business’s internet connection entirely.
DDoS vs. DoS: What’s the Difference
The terms get used interchangeably, but they’re not the same.
A denial-of-service (DoS) attack comes from a single source. One machine, one IP address, one internet connection. Block the IP and the attack stops. That’s manageable, if annoying.
A distributed denial-of-service (DDoS) attack coordinates thousands of sources. You can’t block them by IP because the IPs are constantly rotating across botnet nodes worldwide. That’s why “just block the traffic" isn’t a real answer.
Practically speaking, virtually all modern denial-of-service attacks are DDoS attacks. Single-source DoS attacks are rare because they’re easy to mitigate. Attackers figured this out around 1999. Everything since has been distributed.
How to Defend Against DDoS Attacks
No single control eliminates DDoS risk. Defense works in layers.
Rate Limiting and Traffic Filtering
Set thresholds on how many requests a single IP can make in a given time window. This alone won’t stop a distributed attack with thousands of rotating IPs, but it eliminates the simplest flood attempts and reduces server load during more sophisticated attacks.
Web application firewalls (WAFs) can filter traffic based on request signatures, geographic origin, and behavioral patterns. Modern WAFs can identify and block Slowloris-style attacks and common HTTP flood patterns without affecting legitimate users.
Anycast Network Diffusion
Large CDN and cloud providers use anycast routing, which distributes incoming traffic across multiple data centers globally. Instead of all attack traffic hitting a single point, it gets distributed across a massive network with far more total bandwidth than any botnet can generate.
This is why putting your infrastructure behind a provider like Cloudflare or AWS CloudFront provides meaningful DDoS protection without requiring you to build anything yourself.
Upstream Scrubbing Centers
Specialized DDoS mitigation providers route your traffic through scrubbing centers before it reaches your infrastructure. Malicious packets are filtered out; legitimate traffic is forwarded clean. Providers like Radware, Imperva, and Akamai offer this as a managed service.
Redundancy and Failover
A server that goes down ends the conversation. Multiple servers across different geographic regions mean a localized attack doesn’t take everything offline. Auto-scaling infrastructure can also absorb sudden traffic spikes, whether from attacks or genuine demand.
Incident Response Planning
Know what you’ll do before you need to do it. That means having a designated point of contact at your DDoS mitigation provider, a documented escalation process, and clear communication protocols for informing customers and stakeholders during an outage. An attack is the wrong time to figure out who has the credentials for your CDN dashboard.
DDoS Attacks and Cloud Desktop Infrastructure
If your team runs applications on physical servers sitting in an office or co-location facility, a successful DDoS attack on your IP range can cut everyone off at once. There’s no failover. There’s no geographic distribution. The attack succeeds completely.
Cloud-hosted virtual desktops change the exposure profile. When compute lives in a major cloud provider’s data center, your users connect through that provider’s network, which has orders of magnitude more bandwidth than any SMB could provision independently. Volumetric attacks that would saturate a business internet connection don’t reach the application layer.
That said, cloud infrastructure isn’t immune. Application layer attacks can still target login portals and web-facing components. The difference is in the defensive posture: cloud providers have DDoS mitigation built into their network fabric, whereas on-premise infrastructure requires you to purchase and configure it separately.
Our secure remote access solutions sit behind enterprise-grade network protection as part of the infrastructure, not as an add-on you need to configure yourself. For organizations that moved to cloud desktops partly for uptime and availability reasons, that protection carries real operational weight.
If your current setup has a single public IP address and no upstream scrubbing, you are measurably more exposed than you need to be. Moving infrastructure to the cloud doesn’t eliminate risk. It does reduce the attack surface and shift mitigation responsibility to a team built to handle it.
DDoS Attack Indicators: What to Watch For
You won’t always know immediately that you’re under a DDoS attack. The early signs overlap with other problems: slow load times, intermittent connectivity, users reporting they can’t reach your application.
Watch for these patterns:
- Unusual traffic spikes from a single geographic region or IP range, especially outside normal business hours
- Traffic spikes that do not correlate with any marketing activity or known business event
- A sudden increase in requests to a single endpoint, particularly one that requires heavy server-side processing
- Server response times climbing without a corresponding increase in CPU from legitimate workloads
- Network monitoring alerts showing bandwidth utilization at or near capacity with no identifiable internal cause
Network monitoring tools like Datadog, Zabbix, or even basic SNMP alerts can surface these early. The faster you identify an attack, the faster you can activate mitigation controls, route to a scrubbing center, or null-route the offending traffic.
DDoS Attacks and Cybersecurity Compliance
If your organization operates under a regulatory framework, DDoS resilience is likely part of what you’re expected to document.
HIPAA requires covered entities and business associates to have contingency plans that address service disruptions, including those caused by cyberattacks. A DDoS attack that takes a patient portal offline is a covered event. You need a documented response process.
SOC 2 Type II audit criteria include availability as a Trust Services Criterion. Auditors will look at whether you have controls in place to detect and recover from availability threats, which includes DDoS events.
ISO 27001 addresses availability under Annex A controls for information security continuity. Organizations pursuing certification need documented and tested availability controls.
If you’re evaluating VDI for healthcare or other regulated verticals, factor DDoS protection into your infrastructure assessment. The question isn’t just “does this solution work?" but “does it work when someone is actively trying to prevent it from working?"
Did you learn what is a DDoS attack? Keep learning!
Related Glossary Terms
