Table of Contents
Understanding DDoS in Networks
What DDoS Is
A Distributed Denial of Service, or DDoS, is an attack that tries to make a network service, website, or application unavailable by overwhelming it with traffic coming from many sources at the same time.
In a simple Denial of Service (DoS) attack there is usually one attacking system sending too much traffic to a single victim. In a DDoS attack, many systems are controlled to send traffic toward the same target. Because the traffic comes from many different places, it is harder to block and can be much larger in volume.
DDoS targets the availability part of the CIA triad that you saw in the parent chapter. The attacker is not necessarily trying to steal data or change it. The main goal is to stop legitimate users from accessing a service.
Basic Building Blocks of a DDoS Attack
Botnets and Attack Sources
Most DDoS attacks use a botnet. A botnet is a group of compromised devices that are remotely controlled by an attacker. These devices can be regular computers, servers, or even IoT devices such as cameras or home routers.
Once an attacker has control over many such devices, they can instruct all of them to send traffic to the same victim at the same time. From the victim’s perspective, the attack appears to come from thousands or millions of different IP addresses.
In some cases, attackers also use misconfigured servers on the internet as “helpers” to amplify traffic. The attacker sends small requests to these servers and tricks them into sending much larger replies to the victim. This is called amplification, which you will see again in specific DDoS types.
DDoS vs Normal Traffic Spikes
A website can become slow or unreachable during a normal traffic spike, for example during a big sale or a popular live event. The difference is intent and pattern. A DDoS has a malicious intent and usually shows unnatural traffic patterns, such as very high request rates from many random IPs or traffic that is not typical for normal users.
However, at the technical level, DDoS traffic often looks similar to normal traffic. It uses the same protocols and ports, which is why detection and protection are challenging.
Main Categories of DDoS Attacks
DDoS attacks can target different parts of the network stack. At a high level, they are usually grouped into three main categories that focus on different layers and resources.
| Category | Main Target | Typical Effect |
|---|---|---|
| Volumetric attacks | Bandwidth and links | Saturates internet connection |
| Protocol / network attacks | Network and transport resources | Exhausts routers, firewalls, state tables |
| Application layer attacks | The application itself | Exhausts CPU, memory, or app threads |
These categories help you think about what kind of resource the attacker is trying to exhaust.
Volumetric DDoS Attacks
Volumetric attacks try to consume the available bandwidth of the victim or of the networks around the victim. The idea is simple: send so much data across the network that normal users cannot get through.
Concept of Bandwidth Saturation
Every link has a maximum throughput, for example 1 Gbps. If attack traffic reaches or exceeds that limit, the link is saturated. At that point, queues fill up, packets get dropped, and latency and packet loss increase for all traffic. Eventually, legitimate traffic is almost fully blocked.
In a volumetric DDoS, the key resource under attack is network bandwidth. Once the incoming traffic rate is close to the maximum link capacity, normal traffic will be dropped or heavily delayed.
Reflection and Amplification
Many volumetric DDoS attacks use reflection and amplification. Reflection means the attacker sends a request to a server but uses the victim’s IP address as the source. The server replies to the victim instead of the attacker. Amplification means the reply is much larger than the request.
For example, if a 60 byte request causes a 3000 byte reply, then the amplification factor is:
$$\text{Amplification factor} = \frac{\text{reply size}}{\text{request size}} = \frac{3000}{60} = 50$$
That means 1 Mbps of traffic from the attacker can turn into 50 Mbps of traffic toward the victim.
Common reflection and amplification sources include misconfigured DNS, NTP, or other UDP based services that send large responses to small queries.
Volumetric attacks often measure in Gbps or even Tbps. The huge volume means that defense is often performed in the service provider or in the cloud, before the traffic even reaches the victim’s local network.
Protocol and Network Layer DDoS
Protocol or network layer attacks target the way network protocols work. They often consume CPU, memory, or state tables on network devices such as firewalls, load balancers, and servers.
These attacks usually operate around the network and transport layers, and they do not necessarily need extremely high bandwidth to be effective. They focus on details of packet processing.
SYN Flood as a Classic Example
One of the most common protocol based DDoS attacks is the SYN flood. In this attack, the attacker sends a large number of TCP SYN packets, which are used to start a TCP connection. The server allocates resources for each possible new connection and waits for the next step of the handshake that never arrives.
Since the chapter on the transport layer will explain the handshake in detail, you only need to understand the effect here: the server reserves space for many half open connections and eventually runs out of room to accept new legitimate connections.
Other Protocol Level Attacks
There are other protocol based attacks that focus on features such as fragmentation, ICMP, or specific protocol options. The shared goal is to create more work for the target system per packet, or to exploit limits in tables that track connections or sessions.
In many cases, these attacks exploit the fact that network and security devices must examine or remember information about flows, which costs CPU cycles and memory. When too many such flows are created quickly, devices can become overloaded even if the total bandwidth is not extremely high.
Application Layer DDoS
Application layer DDoS attacks target specific applications, such as web servers, APIs, or DNS servers. Instead of focusing only on packets and bandwidth, they focus on how the application uses CPU, memory, and other resources when handling requests.
Fewer Packets, More Work
An application request can be small at the network level but expensive to process. For example, a complex search query might require the database to scan large amounts of data. An attacker can send many such expensive requests. The total bandwidth might look normal, but the server’s CPU or database gets overloaded.
From a network perspective, this traffic typically uses legitimate protocols such as HTTP or HTTPS and looks similar to normal user traffic. That makes application layer DDoS difficult to distinguish from real usage spikes.
Targeting Specific Functions
Since these attacks focus on the application, the attacker might choose specific URLs or API calls that are known to be slower or more resource hungry. For example, generating reports, searching across large datasets, or triggering file processing.
Defending against this type of DDoS usually requires visibility and intelligence at the application layer, not just at the network layer.
Common Impacts of DDoS on Networks
Even though DDoS attacks have different forms, the visible effects on a victim network have some common patterns.
Services may become slow or completely unreachable. Users might see timeouts, error pages, or experience long delays. Internal monitoring might show high CPU usage on servers, high utilization on links, or high session counts on firewalls and load balancers.
DDoS can also affect networks that are not the direct target. If attack traffic crosses shared infrastructure, other customers or services on the same links can experience congestion. This collateral damage is one reason service providers take DDoS seriously.
In some cases, DDoS is used as a distraction. While defenders are busy with availability issues, attackers might try other attacks such as data theft. This combination turns DDoS into part of a larger attack strategy.
Basic Detection Concepts
Detailed monitoring and troubleshooting are covered later in the course, but it is useful to understand at a high level how DDoS is often detected.
Network operators look for unusual patterns such as sudden spikes in traffic volume, large numbers of connections from unusual regions, or an abnormal mix of protocols and ports. They might compare current traffic to baselines that describe normal behavior.
At the application layer, operators can monitor metrics such as requests per second, error rates, and average response times. Sudden, sustained changes in these values can indicate an attack.
Detection usually needs to be fast because DDoS attacks can grow very quickly. Automated systems are often used to trigger mitigation within seconds or minutes.
Basic Defense and Mitigation Ideas
DDoS protection is a broad topic that touches many other networking concepts, so here we keep to the specific, high level ideas.
On the network side, mitigation can involve rate limiting, traffic filtering, and using special DDoS protection services that absorb or scrub traffic in the cloud before it reaches the victim. For volumetric attacks, this is often the only realistic approach, because local links cannot carry the full attack volume.
For protocol and application layer attacks, defenses can include hardening servers and network devices, tuning timeouts and limits, and using specialized appliances or services that understand the protocols deeply. Some techniques separate malicious from legitimate traffic based on behavior, such as requiring additional verification steps only when suspicious patterns appear.
Effective DDoS defense usually combines:
- Upstream capacity and filtering to handle large volumes.
- Smart detection to identify abnormal patterns quickly.
- Application aware protections to distinguish real users from attack traffic.
Even simple measures, such as having a clear incident response plan and good communication with your internet service provider, can greatly reduce the impact of an attack.
How DDoS Fits into Overall Network Security
Within the broader topic of network security fundamentals, DDoS is a prime example of an attack on availability. It shows why network design, capacity planning, and cooperation with external providers are all part of security, not just firewalls and encryption.
When you study later chapters such as firewalls, ACLs, monitoring, and traffic engineering, you will see many concepts that help in defending against DDoS or in reducing its impact. DDoS sits at the intersection of routing, capacity, and security, which is why understanding its basic ideas is important even for beginners.