What Is a DDoS Attack? How It Works and How to Protect Yourself

A distributed denial-of-service (DDoS) attack is a cyberattack in which an attacker uses a network of hijacked devices, known as a botnet, to flood a website, server, or online service with traffic all at once. The flood consumes the target's bandwidth, connection capacity, or application resources until it slows to a crawl or stops responding entirely, blocking legitimate visitors in the process. DDoS attacks don't steal data; their goal is disruption, and they typically fall into three categories — volumetric, protocol, and application-layer — that attackers often combine for maximum effect.

How a DDoS Attack Works

Every DDoS attack follows the same basic sequence. First, an attacker assembles a botnet — a collection of devices infected with malware that lets the attacker control them remotely without their owners' knowledge. These "bots" or "zombies" can be ordinary laptops, but increasingly they're poorly secured routers, IP cameras, and other internet-of-things gear. According to Akamai's security glossary, the attacker then sends instructions that direct the bots to send traffic toward a single target simultaneously, and botnets are frequently rented out through so-called attack-for-hire or "booter/stresser" services, putting serious firepower within reach of unskilled attackers.

Because the traffic arrives from thousands or millions of distinct IP addresses rather than one source, it is far harder to distinguish from genuine visitors and far harder to block with a simple IP ban. The target's servers, firewalls, or network links can only handle so much traffic or so many simultaneous connections; once that capacity is exceeded, the system slows down, times out, or crashes outright, and real users can no longer get through.

DDoS vs. DoS: What's the Difference?

A denial-of-service (DoS) attack and a distributed denial-of-service (DDoS) attack share the same goal — knocking a target offline — but differ in scale and origin. A DoS attack comes from a single machine or network connection, which makes it comparatively easy to stop: a defender can usually identify and block the one source. A DDoS attack spreads the same flood across a botnet of many devices and IP addresses, often located around the world, so there is no single source to block. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), together with the FBI and MS-ISAC, treats DDoS as the far more common and disruptive version of the two in its joint guidance for network defenders, which is why most modern "denial-of-service" incidents reported publicly are in fact distributed.

The Three Main Types of DDoS Attacks

CISA's joint guide with the FBI and MS-ISAC, along with documentation from AWS and Akamai, consistently groups DDoS techniques into three categories. Attackers frequently blend more than one type in a single campaign to overwhelm both network capacity and application logic at once.

Volumetric Attacks

Volumetric attacks are the most straightforward: the goal, per AWS's Shield documentation, is simply to "saturate the capacity of the targeted network or resource" with enough raw traffic that nothing else can get through, the same way a highway jams when far more cars try to use it than it was built for. A UDP flood bombards random ports with User Datagram Protocol packets; a DNS amplification attack abuses the way DNS servers respond to small queries with much larger answers, spoofing the victim's address so the oversized replies land on the target instead of the attacker. These attacks are measured in bits per second, and the largest now regularly exceed one terabit per second.

Protocol Attacks

Protocol attacks don't necessarily need huge volumes of traffic; they exploit how network protocols work. AWS describes the classic example, a TCP SYN flood, as a technique that "can exhaust connection state on resources like servers, load balancers, or firewalls." Normally, establishing a TCP connection requires a three-step handshake. In a SYN flood, the attacker sends a wave of connection requests and never completes the handshake, leaving the server holding open half-finished connections until it runs out of memory or connection slots for legitimate traffic.

Application-Layer (Layer 7) Attacks

Application-layer attacks are the hardest to detect because the individual requests often look completely legitimate — a normal page load, a normal search query, a normal login attempt — just repeated at a volume no real user would generate. An HTTP flood might hammer a specific search page or login form that's expensive for the server to process; Slowloris instead opens many connections and sends data to each one as slowly as possible, tying up server threads that are waiting for requests to finish. Because these attacks mimic valid application behavior, blocking them requires understanding normal usage patterns well enough to spot the anomaly, not just filtering by traffic volume.

How Botnets Power DDoS Attacks

Botnets are the engine behind nearly every large DDoS attack. Devices are recruited into a botnet after being compromised — often through phishing or other social engineering that tricks a user into installing malicious software, or through automated scans that find internet-connected devices still using default or weak passwords. Once infected, the device quietly waits for commands from the attacker's command-and-control infrastructure, then joins the flood when instructed, often without its owner ever noticing anything beyond slightly higher data usage.

The scale this can reach was underscored by Cloudflare's DDoS threat report for the first half of 2026: the company mitigated 23.2 million network-layer DDoS attacks over the period — roughly 5,343 every hour — and attacks exceeding 1 terabit per second jumped 519% quarter-over-quarter, from 130 in the first quarter to 805 in the second. Cloudflare also mitigated 29.64 trillion HTTP DDoS requests in H1 2026, with April alone accounting for 6.46 trillion requests and 165 petabytes of traffic. Media, production, and publishing companies were the single most-targeted industry, absorbing 14.2% of mitigated HTTP DDoS traffic — nearly four times the next-closest sector. Notably, Cloudflare linked the decline in attack volume after April to Operation PowerOFF, a 21-country law enforcement action that targeted more than 75,000 users of DDoS-for-hire platforms, seized 53 domains, and led to four arrests, illustrating that botnets and the booter services renting them out are very much a live target for international policing.

Warning Signs You're Under a DDoS Attack

CISA's joint guidance lists several symptoms that, together, suggest an active DDoS attack rather than a routine traffic spike or outage:

• A website, application, or API suddenly becomes slow or completely unreachable for most visitors.
• Unusual network congestion or a flood of traffic on specific ports or protocols that doesn't match normal usage.
• Traffic concentrated from an unexpected single IP range, user agent, or geographic region.
• Sudden, unexplained spikes at odd hours with no corresponding marketing push or news event.
• Servers or specific applications crashing or restarting repeatedly under load.

Because some of these symptoms overlap with ordinary misconfigurations, server failures, or even a surge of legitimate interest (sometimes called a "flash crowd"), CISA recommends confirming the pattern with your hosting provider, CDN, or DDoS mitigation service before assuming it's a deliberate attack.

How to Protect Yourself and Your Site

Individuals and organizations face different versions of this problem, but the underlying principles — reduce your attack surface, add capacity and filtering ahead of time, and have a plan — apply to both.

For site operators and businesses:

• Put critical services behind a content delivery network (CDN) or DDoS protection service with globally distributed scrubbing capacity, such as AWS Shield, Cloudflare, or Azure DDoS Protection, rather than relying only on your own servers' bandwidth.
• Use a web application firewall (WAF) alongside network-layer protection; Microsoft's own Azure DDoS Protection documentation notes that its service covers layers 3 and 4, and recommends pairing it with a WAF for layer 7 application coverage.
• Build redundancy across regions or providers so a single point of failure can't take the whole service down, and keep spare bandwidth and connection capacity in reserve.
• Write an incident response plan before an attack happens: know who to call at your ISP or mitigation provider, who has authority to make changes under pressure, and how you'll communicate with customers if the service degrades.
• Enroll in a DDoS protection service proactively. CISA's Capacity Enhancement Guide for federal agencies — a companion to its main DDoS guidance — stresses identifying critical assets and signing up for mitigation services before an attack starts, since provisioning protection reactively during an active flood is far harder.

For individuals:

• Change default passwords and keep firmware updated on routers, IoT devices, and smart-home gadgets; unsecured devices are exactly what botnet operators scan the internet looking for.
• Avoid clicking links or downloading attachments that could deliver the malware that recruits a device into a botnet in the first place — the same hygiene that defends against most malware generally.
• If you play online games or livestream, consider routing traffic through your platform's built-in protection or a reputable proxy/CDN rather than exposing your home IP address directly, since gamers and streamers are common targets of smaller-scale DDoS harassment.
• Never participate in or pay for a DDoS attack, even "as a joke" against a rival in a game — renting or operating a booter/stresser service is a criminal offense in the U.S. and most other jurisdictions, and international operations like Operation PowerOFF are actively prosecuting both operators and paying customers.

What to Do During and After an Attack

If you suspect you're under attack right now, CISA's guidance recommends contacting your internet service provider or DDoS mitigation provider immediately to confirm the pattern and begin filtering malicious traffic; most CDNs and cloud providers have an emergency escalation path for exactly this scenario. Avoid making large, untested infrastructure changes mid-attack, since that can make things worse or mask what's actually happening. Once the attack subsides, document what happened — timeline, traffic patterns, and what mitigations worked — and consider reporting significant incidents to CISA, the FBI, or, for state and local government and critical infrastructure organizations, MS-ISAC, both to get support and to contribute to the broader picture of DDoS activity that agencies and vendors use to track emerging threats like new botnets or amplification techniques.

DDoS attacks are sometimes used as a smokescreen for other malicious activity, so it's also worth checking logs for signs of intrusion attempts, data exfiltration, or exploitation of a zero-day vulnerability that occurred while your security team's attention was on the flood. A layered defense that also covers identity and network access, such as a zero trust security model, reduces the odds that a DDoS incident becomes a cover for a deeper breach.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage