A Distributed Denial-of-Service or DDoS attack is a malicious cyberattack. It attempts to make an online service, like a website or application, unavailable to its intended, legitimate users.

It achieves this by overwhelming the target’s server, network, or resources with a massive flood of illegitimate traffic coming from multiple, distributed sources.

How a DDoS Attack Works?

The “distributed” nature is what distinguishes a DDoS attack from a simple Denial-of-Service (DoS) attack, which uses a single source. A DDoS attack is typically executed in two main stages:

• Creating a Botnet: The attacker first creates a botnet, which is a network of Internet-connected devices (like computers, phones, or IoT devices). The botnet have been secretly infected with malware, turning them into “bots” or “zombies.” The owners of these devices are usually unaware that their machines are being controlled remotely by the attacker.

• Launching the Attack: The attacker then commands all the devices in the botnet to simultaneously send an overwhelming amount of traffic (requests, packets, etc.) to the target server’s IP address. This is similar to a massive traffic jam that clogs a road leading to a destination.
  • The Result: The sheer volume of this fake traffic saturates the target’s network bandwidth and exhausts its resources (like CPU, memory, or connection capacity). The server becomes too busy trying to process the flood of malicious data to respond to any legitimate users, causing the service to slow down, crash, or go completely offline.

Common DDoS Attack Types

DDoS attacks can target different layers of the network connection model (OSI model).

• Volumetric Attacks: Sending a flood of UDP or ICMP packets.
• Protocol Attacks: A SYN Flood, where the attacker initiates a connection handshake but never completes it, tying up server resources.
• Application Layer Attacks: Repeatedly sending complex HTTP requests (like refreshing an expensive search query) that require a lot of server processing power.

Signs of a DDoS Attack

While sometimes difficult to distinguish from a legitimate traffic spike (like a major sales event), common signs include:

• Sudden, inexplicable surge in web traffic from a single IP address, IP range, or region.
• Irregular or extremely slow network performance, including very long loading times.
• Inability to access an online service or website that was previously available.
• A high volume of resource-heavy requests (e.g., login attempts) that are difficult to attribute to genuine users.