What Is a DDoS Attack? Types, Detection, and Protection

A distributed denial-of-service (DDoS) attack attempts to make a website, application, network, or online service unavailable by overwhelming it with traffic or requests from many sources. Instead of trying to steal data directly, the attack targets availability by consuming resources that legitimate users need.

DDoS attacks can affect infrastructure at different layers of the network stack. Some attacks attempt to exhaust bandwidth or network resources, while others generate large numbers of requests against specific application services.

Understanding what a DDoS attack is, how it differs from a traditional denial-of-service attack, and how defenders detect and mitigate abnormal traffic is an important part of modern network security.

What Is a DDoS Attack?

DDoS stands for distributed denial of service. A DDoS attack uses traffic or requests originating from multiple systems to overwhelm a target and interfere with its ability to serve legitimate users.

The word distributed is important. Instead of attack traffic coming from only one source, a DDoS attack can involve many systems generating traffic toward the same target. This distribution can make malicious traffic more difficult to distinguish from legitimate activity and more difficult to stop using a single blocking rule.

The objective is generally to affect availability. If the target exhausts network capacity, connection state, compute resources, or application capacity, legitimate users may experience slow responses, errors, timeouts, or complete loss of service.

How Does a DDoS Attack Work?

Every internet-facing service has finite resources. Networks have bandwidth limits, servers can maintain only so many connections, and applications can process only so many requests within a given period.

A DDoS attack attempts to consume enough of those resources that legitimate activity can no longer be handled normally.

Traffic reaches the target: Large volumes of network traffic or application requests are directed toward a service.
Resources are consumed: Network capacity, connections, memory, CPU, application workers, or other finite resources may become constrained.
Performance degrades: Legitimate requests begin taking longer to process or fail entirely.
Availability is affected: Users may encounter slow pages, connection failures, errors, or an unavailable service.

The exact behavior depends on the type of attack and the part of the infrastructure being targeted.

DoS vs DDoS: What's the Difference?

A denial-of-service (DoS) attack and a distributed denial-of-service (DDoS) attack share the same general objective: disrupting the availability of a system or service. The primary difference is how the attack traffic is generated.

DoS: The disruptive traffic or activity originates from a more limited source, traditionally a single attacking system.
DDoS: The attack is distributed across many systems or sources that collectively direct traffic toward the target.

This distribution can make DDoS attacks more difficult to mitigate. Blocking one source may have little effect when traffic continues arriving from many other systems.

What Do Layer 3, Layer 4, and Layer 7 DDoS Attacks Mean?

DDoS attacks are often described by the layer of the network stack they target. These numbers refer to layers of the OSI model, a framework used to describe how network communication works.

Layer 3 — Network Layer: Handles network addressing and routing using protocols such as IP. Attacks at this layer can attempt to overwhelm network infrastructure or available bandwidth.
Layer 4 — Transport Layer: Handles end-to-end communication using protocols such as TCP and UDP. Attacks at this layer can target connections, protocol behavior, or resources required to maintain network communication.
Layer 7 — Application Layer: Includes application protocols such as HTTP and HTTPS. Layer 7 DDoS attacks can overwhelm websites or APIs by generating large volumes of application requests.

The distinction matters because defenses that work against one type of DDoS attack may not address another. A Layer 7 HTTP flood, for example, creates a different defensive problem than an attack designed primarily to consume network bandwidth.

Common Types of DDoS Attacks

DDoS attacks are not a single technique. They can target different resources and layers of infrastructure. A useful way to understand them is to group attacks according to what they attempt to exhaust.

Volumetric Attacks

Volumetric attacks attempt to consume available network bandwidth by generating very large amounts of traffic. If malicious traffic consumes enough capacity, legitimate traffic may struggle to reach the target.

Protocol and State-Exhaustion Attacks

Other attacks target network devices, connection-tracking mechanisms, or protocol-related resources. Rather than relying only on raw bandwidth, these attacks attempt to consume finite infrastructure resources required to establish or maintain communication.

Application-Layer Attacks

Application-layer DDoS attacks target services such as websites and APIs by generating requests that require the application to perform work. Individual requests may resemble ordinary user traffic, but the aggregate request volume or behavior can place significant pressure on the application. A web application firewall (WAF) can help inspect and control this type of application-layer traffic.

HTTP-based attacks are particularly relevant to web defenders because malicious requests can travel over the same HTTP and HTTPS services that legitimate users depend on.

What Does a DDoS Attack Look Like?

A DDoS attack does not always appear as a website suddenly disappearing. Defenders may first observe changes in traffic patterns, infrastructure utilization, application latency, or error rates.

Unexpected traffic spikes: Request or network volume rises far above normal baselines.
Increased latency: Applications take longer to respond as resources become constrained.
Higher error rates: Users begin receiving timeouts, failed connections, or server errors.
Unusual source distribution: Large numbers of systems or networks begin accessing the same service.
Repeated request patterns: Similar requests appear at unusually high frequency.
Resource pressure: Bandwidth, CPU, memory, connection capacity, or application workers approach their limits.

None of these signals alone proves that a DDoS attack is occurring. Traffic spikes can also result from legitimate events, software behavior, marketing campaigns, or sudden increases in user demand. Defenders need context to distinguish malicious activity from legitimate traffic.

How Are DDoS Attacks Detected?

DDoS detection typically depends on understanding normal traffic and identifying significant deviations from that baseline. Monitoring systems can examine traffic volume, request rates, connection behavior, source distribution, application performance, and other telemetry.

Useful detection signals can include:

Requests per second: Sudden increases can indicate abnormal demand or automated traffic.
Bandwidth utilization: Large traffic increases may indicate volumetric activity.
Source patterns: Defenders can examine where traffic originates and how sources behave.
HTTP behavior: Application defenders can analyze requested paths, methods, user agents, and request frequency.
Error and latency changes: Increasing response times or failure rates can reveal resource pressure.
Historical baselines: Current activity can be compared with expected traffic for the service.

Effective detection is therefore not simply about identifying a large number of requests. It requires determining whether traffic is consistent with legitimate use or represents activity intended to disrupt availability.

How Are DDoS Attacks Mitigated?

DDoS mitigation is designed to absorb, filter, rate-limit, or otherwise manage malicious traffic while allowing legitimate users to continue reaching the protected service.

The appropriate defenses depend on the type and scale of the attack. Organizations commonly combine multiple controls rather than relying on a single mechanism.

Traffic filtering: Identify and reject traffic that matches malicious or clearly unwanted patterns.
Rate limiting: Restrict excessive request rates before they overwhelm downstream resources.
Distributed infrastructure: Spread traffic across infrastructure capable of handling larger volumes.
DDoS protection services: Use specialized infrastructure designed to detect and absorb large-scale attacks.
Web application firewalls: Inspect and control HTTP and HTTPS requests during application-layer attacks.
Monitoring and alerting: Detect abnormal behavior early enough for defenders to investigate and respond.

Can a Firewall Stop a DDoS Attack?

A firewall can contribute to DDoS defense, but it should not be treated as a complete solution to every type of denial-of-service attack.

Firewalls can reject unwanted connections and enforce network access policies. However, sufficiently large traffic volumes may consume upstream network capacity before a traditional firewall can solve the availability problem.

Application-layer attacks create another challenge because malicious requests may arrive through services that intentionally need to remain accessible. For example, a public website normally allows HTTPS traffic on port 443, so defenders may need additional application-aware controls to distinguish abusive requests from legitimate ones.

How a WAF Helps With Application-Layer DDoS Attacks

A web application firewall (WAF) can inspect HTTP and HTTPS requests before they reach an application. This makes WAF controls useful for responding to some forms of abusive application-layer traffic.

Rate-based rules can restrict clients generating unusually large numbers of requests, while other controls can evaluate request paths, reputation signals, known malicious patterns, and additional characteristics of web traffic.

A WAF is still only one layer of defense. Large-scale DDoS protection may require controls operating across networks, edge infrastructure, content delivery systems, application services, and specialized mitigation platforms.

AWS WAF and AWS Shield for DDoS Protection

Cloud environments can combine multiple services to defend against DDoS attacks. In AWS, AWS WAF can inspect and control HTTP and HTTPS requests at the application layer, while AWS Shield provides DDoS protection designed to help defend internet-facing resources against denial-of-service attacks.

AWS Shield Standard provides baseline DDoS protection for AWS customers, while AWS Shield Advanced provides additional detection, mitigation, and response capabilities. Shield Advanced can also work with AWS WAF to provide application-layer DDoS protection.

For Shield Advanced-protected AWS WAF resources, AWS currently includes up to 50 billion requests per calendar month as part of the Shield Advanced subscription. This can also affect how organizations plan for the potentially significant request volume associated with large application-layer attacks.

DDoS Detection vs DDoS Protection

Detection and protection solve related but different problems.

Detection: Determines that traffic or system behavior may represent a denial-of-service attack.
Protection: Takes action to reduce the attack's impact and preserve availability for legitimate users.

Strong defensive architectures need both. Blocking traffic without sufficient visibility can affect legitimate users, while detecting an attack without mitigation leaves the service exposed to disruption.

Why DDoS Telemetry Matters

Traffic generated during an attack can provide defenders with valuable security telemetry. Rather than looking only at whether a request was allowed or blocked, analysts can examine patterns across thousands or millions of events.

Useful questions include whether activity is concentrated around particular endpoints, whether sources share behavioral characteristics, whether request rates change over time, and whether multiple weak signals together indicate coordinated activity.

This is where traditional analytics and AI-assisted analysis can complement each other. Deterministic systems are effective at filtering, aggregating, counting, and applying thresholds across large datasets. AI systems can then help analysts interpret summarized telemetry, correlate patterns, and explain potentially important findings.

DDoS Attacks and the CIA Triad

Cybersecurity is often described through three fundamental security objectives: confidentiality, integrity, and availability.

DDoS attacks primarily target availability. Even if an attacker never reads confidential information or modifies stored data, preventing legitimate users from accessing an important system can still create serious operational consequences.

That makes availability monitoring, capacity planning, resilient architecture, and denial-of-service protection important parts of a broader cybersecurity program.

Why Cybersecurity Learners Should Understand DDoS

DDoS attacks connect several foundational cybersecurity concepts: networking, protocols, traffic analysis, web security, monitoring, incident response, and resilient system design.

For defenders, the important skill is not simply memorizing what DDoS stands for. It is understanding how abnormal traffic affects infrastructure, what telemetry reveals that behavior, and which defensive controls operate at different layers of the environment.

Those concepts are especially relevant for network administrators, security operations analysts, cloud defenders, and cybersecurity professionals responsible for maintaining the availability of internet-facing systems.

Explore HuntCode

HuntCode is building hands-on cybersecurity learning experiences around practical defensive skills, AI-powered guidance, and real security workflows. Learners can develop an understanding of network security, web application security, security telemetry, threat detection, and other concepts used in modern defensive environments.

Learners: Explore HuntCode to develop practical cybersecurity skills through lessons, labs, and AI-powered learning experiences.
More from HuntCode: Follow our blog for articles on network security, web application security, AI in cybersecurity, threat intelligence, and hands-on cyber defense.

A DDoS attack does not need to break into a system to cause damage. Sometimes preventing legitimate users from reaching it is the attack.