A distributed denial-of-service attack uses many machines, usually a botnet of hijacked devices, to flood a target with traffic until legitimate users cannot reach it. The goal is unavailability, not theft. Preparation matters more than reaction: you need monitoring, a traffic-filtering option and a written plan before the first packet arrives.
How does a DoS attack differ from a DDoS attack?
CISA defines a denial-of-service condition as one where legitimate users cannot access systems or network resources because of a threat actor's actions, usually by flooding the target with traffic until it cannot respond or crashes. In a DDoS, multiple machines operate together against one target.
The distributed part changes two things. Volume rises sharply, and attribution gets harder, because the traffic arrives from thousands of addresses instead of one. CISA also notes that botnets can be rented to attack-for-hire services, which lets unskilled users launch attacks. The hijacked devices are victims too.
What forms does the flooding take?
CISA's guidance describes a few classic types.
A SYN flood abuses the TCP three-way handshake. The attacker starts connections but never completes them, leaving ports occupied until real users cannot connect.
A Smurf attack sends ICMP broadcast packets with a spoofed source address belonging to the target. The hosts that receive them all reply to the victim.
A basic request flood sends many illegitimate requests with fabricated return addresses, so the server keeps working on junk.
You may also be hit without being the target. If your internet or cloud provider is attacked, your service degrades with it.
Why are IoT devices part of the story?
CISA says DDoS attacks have grown in magnitude as more devices come online through the Internet of Things, many with default passwords and weak security. Their owners often never notice an infection. Changing default credentials and updating firmware on your own devices reduces your part in the problem.
How do you know it is an attack?
Symptoms can look like ordinary trouble: unusually slow network performance, a website that is unavailable, or no access to any site. CISA notes the most reliable way to detect an attack is network traffic monitoring and analysis, through a firewall or intrusion detection system, with alerts on anomalous traffic loads.
A constructed example: a ticketing site slows at 14:10. Support reports timeouts. The on-call engineer checks the load balancer graph and sees requests per second at twelve times normal, mostly to a single search URL, from a wide spread of addresses. That pattern points to an attack, where a deployment bug would show errors at normal traffic.
What do you do during an attack?
CISA's advice maps to a short sequence. Contact your network administrator to confirm the cause is not maintenance or an internal fault. Have them monitor traffic, identify sources and apply firewall rules, possibly rerouting traffic through a DoS protection service that filters bad traffic and passes clean traffic. Contact your ISP to learn whether the outage is on their side.
One more line from CISA deserves attention: do not lose sight of the other assets on your network. Some attackers use a DoS as a distraction while they attack something else.
How to check or apply this
- Set baseline traffic levels and alerts for abnormal spikes, per service.
- Decide in advance who may call your ISP or a traffic-filtering service and at what threshold.
- Write a runbook: confirm, contain, communicate, recover. Include a status page owner.
- Keep a path to scale or shed load, such as caching static pages and rate limiting expensive endpoints.
- Harden your own devices so they do not join someone else's botnet: unique passwords, current firmware, firewall rules for inbound and outbound traffic.
- During an event, watch authentication logs and other services for secondary activity.
- After the event, review what slowed you down and update the runbook.
This is a network availability problem, so Safeguard is not the tool for it. What Safeguard can contribute is on the application side, such as finding code paths or dependencies that make cheap requests expensive.
Quick check
Is a DDoS attack the same as a data breach?
No. A DDoS aims to make a service unavailable. But CISA warns that attackers sometimes use it as a distraction, so you should keep watching your other systems.
Can you fully prevent a DDoS attack?
CISA says there is no way to completely avoid becoming a target. You can reduce the effect with monitoring, a filtering service, a recovery plan and secure devices.
Sources
Last reviewed: 18 October 2026.
