DDoS Attacks: Types, Impact & Mitigation Strategies

A Distributed Denial of Service (DDoS) attack overwhelms a target system with traffic from multiple sources, making it unavailable to legitimate users. Unlike a DoS attack from a single source, DDoS attacks are distributed across hundreds or thousands of compromised devices.

DDoS attacks work by exhausting one or more resources: network bandwidth, server processing power, memory, connection tables, or application-specific resources. The goal is not to break in but to make the service unusable — causing financial losses, reputation damage, and operational disruption.

Botnets — networks of malware-infected computers, IoT devices, and servers — are the primary DDoS weapon. Operators rent botnet access on darknet marketplaces, making DDoS attacks accessible even to non-technical attackers. Some botnets contain millions of compromised devices.

The scale of DDoS attacks has grown dramatically. Modern attacks regularly exceed 1 Tbps (terabits per second), with the largest recorded attacks exceeding 3.47 Tbps. Cloud-based amplification techniques allow small numbers of attackers to generate enormous traffic volumes.

Volumetric attacks flood the target's bandwidth with massive traffic. UDP floods send large volumes of UDP packets to random ports, ICMP floods overwhelm with ping requests, and DNS amplification uses public DNS servers to multiply attack traffic by 50-70 times.

Protocol attacks exploit weaknesses in network protocols. SYN floods send massive numbers of TCP connection requests without completing the handshake, exhausting the server's connection table. Ping of Death sends oversized ICMP packets, and Smurf attacks use ICMP broadcast amplification.

Application layer attacks (Layer 7) target specific applications with legitimate-looking requests. HTTP floods send massive numbers of GET or POST requests, Slowloris holds connections open with partial HTTP headers, and DNS query floods overwhelm DNS servers with lookup requests.

Multi-vector attacks combine techniques from multiple categories simultaneously. As the target mitigates one attack type, additional vectors maintain pressure. These sophisticated attacks require more complex defense strategies.

Financial impact: DDoS attacks cost organizations an average of $40,000 per hour of downtime. For e-commerce platforms, financial services, and SaaS providers, even brief outages can result in significant revenue loss and customer churn.

The Mirai botnet (2016) compromised hundreds of thousands of IoT devices (cameras, DVRs, routers) and launched attacks exceeding 1 Tbps, taking down major websites including Twitter, Netflix, and Reddit through the Dyn DNS provider.

GitHub experienced the largest recorded DDoS attack in 2018 (1.35 Tbps) using memcached amplification. GitHub's use of a DDoS mitigation service allowed them to recover within minutes — demonstrating the importance of preparedness.

DDoS attacks are increasingly used as distractions. While the security team focuses on restoring service, attackers may simultaneously conduct data exfiltration, malware deployment, or other intrusions that go unnoticed during the chaos.

Cloud-based DDoS protection services (Cloudflare, AWS Shield, Akamai) absorb attack traffic across their global networks before it reaches your infrastructure. These services have the bandwidth capacity to handle the largest attacks and can scrub malicious traffic in real-time.

Rate limiting restricts the number of requests a server accepts from a single source within a given time period. While it cannot stop distributed attacks alone, rate limiting prevents individual sources from consuming disproportionate resources.

Anycast routing distributes traffic across multiple data centers worldwide. During an attack, traffic is absorbed across the entire network rather than concentrated at a single point. This architectural approach is fundamental to enterprise DDoS resilience.

Develop a DDoS response plan before an attack occurs. Identify critical services, establish communication channels, document escalation procedures, and test your mitigation capabilities regularly. During an attack, coordinate with your ISP, hosting provider, and DDoS mitigation service.