DDoS protection is layered. A scrubbing service absorbs and filters traffic upstream, network controls block spoofed packets, servers resist connection floods, and a rehearsed plan covers the rest. CISA says no one can fully avoid being a target, so the goal is to reduce the effect.
What is a DDoS attack?
CISA describes a denial-of-service attack as one where legitimate users cannot reach information systems, devices or other resources because of a threat actor's actions. A distributed attack uses many machines acting together against one target. Attackers often use a botnet, a group of hijacked internet-connected devices, and CISA notes that botnets can be rented out to others through attack-for-hire services.
CISA also notes that IoT devices often use default passwords and weak security, so hundreds of thousands can be compromised without their owners knowing. Your devices can be part of someone else's attack as well as the target of one.
Which attacks should you plan for?
CISA names two classic examples. A SYN flood sends connection requests and never completes the three-way handshake, which leaves ports occupied. A Smurf attack sends ICMP broadcast packets with the target's spoofed address so that many hosts reply to the victim at once.
Other attacks exhaust the application instead of the network, for example by repeatedly requesting an expensive search page. The OWASP API Top 10 lists unrestricted resource consumption as a risk because it can cause denial of service or higher costs.
What does each layer do?
Upstream filtering. CISA's advice is to enrol in a DoS protection service that detects abnormal traffic flows and redirects traffic away from your network, so the attack traffic is filtered out and clean traffic passes on. This is the only layer that works against floods larger than your own internet link, because the flood must be absorbed before it reaches you.
Spoofing controls. RFC 2827 describes network ingress filtering to defeat denial of service attacks that use forged source addresses. If networks drop packets whose source address could not have come from them, reflection and spoofed floods lose power. You can apply it on your own edge, and your provider may offer it.
Connection flood defences. RFC 4987 documents TCP SYN flooding and common mitigations, including SYN cookies, which avoid holding state for half open connections. Most operating systems implement some of these, and enabling and tuning them is a quick win.
Application limits. Rate limits, caching, queueing and capacity for expensive operations keep a small attack from becoming an outage. Put the costliest routes behind authentication where you can.
A constructed example
An online ticket seller expects a surge for a concert sale and, a week earlier, receives a threatening message. The team has three days.
They move the public site behind a filtering service, cache the event pages, add rate limits on the purchase route and set a queue so purchase attempts line up rather than overwhelm the database. They check that the origin server accepts connections only from the service's addresses, so attackers cannot bypass the filter by going straight to it. They also brief support on what to say if the site slows. The sale proceeds. Some users see a short waiting page, which is the outcome the queue was built for.
What do you do during an attack?
CISA's advice: contact your network administrator to confirm whether it is an attack or maintenance, ask your ISP whether its network is affected, and apply firewall rules or reroute traffic through a protection service. It also warns not to lose sight of other assets, because many attackers use a DoS to distract from a secondary attack on other services. Keep your normal monitoring running and watch for unrelated intrusion signs.
How to check or apply this
- Find your weakest point: network capacity, a database query or a single costly route.
- Put public services behind a filtering service and lock the origin to accept only its traffic.
- Apply ingress filtering at your edge and enable SYN flood protections on servers.
- Add rate limits and caching to expensive routes.
- Write a runbook with contacts for your provider, ISP and filtering service.
- Monitor traffic baselines so you can recognise abnormal load quickly.
- Secure your own devices, since compromised IoT gear feeds attacks on others.
- Rehearse once a year, including a distraction scenario.
Quick check
Can a firewall alone stop a DDoS attack?
No. A firewall on your link cannot stop traffic that fills the link. Upstream filtering is needed for large floods.
What is a SYN flood?
An attack that sends connection requests without completing the handshake, leaving the server holding half open connections until legitimate users cannot connect.
Sources
- CISA, Understanding Denial-of-Service Attacks
- RFC 4987, TCP SYN Flooding Attacks and Common Mitigations
- RFC 2827, Network Ingress Filtering
- OWASP API Security Top 10, 2023
Last reviewed: 18 October 2026.
