A denial of service attack, or DoS, makes a service unavailable to legitimate users, usually by flooding it with traffic or requests until it cannot respond. A distributed attack, DDoS, does the same from many machines. You cannot prevent being targeted, but you can reduce the impact with capacity, filtering, rate limits and a plan.
How does a flood work?
CISA's explainer defines DoS as the condition where legitimate users cannot access information systems, devices or other network resources because of a malicious actor's actions. Services affected may include email, websites and online accounts.
The most common method it describes is flooding a server with illegitimate requests until it is overwhelmed. Two named examples:
- A SYN flood. TCP connections begin with a three way handshake. The attacker sends connection requests but does not complete the handshake, so the connection is left occupied and unavailable for further requests. Keep that up and all open ports saturate.
- A Smurf attack. The attacker sends ICMP broadcast packets with a spoofed source address belonging to the target. The hosts that receive them reply to the target, flooding it with responses.
Constructed example: a ticket seller's checkout page slows from two seconds to a timeout. Monitoring shows the web servers idle but the load balancer's connection table nearly full of half open connections. The servers are fine. The front door is clogged.
What makes it distributed?
In a DDoS, multiple machines work together against one target. CISA says attackers often use a botnet, a group of hijacked internet connected devices, taking advantage of vulnerabilities or weak settings to control them with command and control software. Botnets may be rented out, including to attack-for-hire services that let unskilled users launch attacks. Many devices act together, so the traffic is large and hard to attribute. CISA also notes that the infected devices are victims too, and that IoT devices with default passwords are common recruits.
You can also be hit without being the target. If your internet or cloud provider is attacked, your network loses service too.
Does DoS only mean network floods?
No. Application level abuse can exhaust a service with far less traffic. OWASP's API Security Top 10 lists unrestricted resource consumption: satisfying requests needs bandwidth, CPU, memory and storage, and some APIs also trigger paid services such as email or SMS. Successful attacks can cause denial of service or higher operating costs.
Constructed example: a search endpoint allows a wildcard query across a large table with no page size limit. One client requests huge result sets repeatedly. Bandwidth is tiny, but the database is saturated. No botnet needed.
What does CISA recommend?
For administrators, CISA says no one can completely avoid being a target, but you can reduce effects:
- Enroll in a DoS protection service that detects abnormal traffic and redirects it, filtering out attack traffic and passing clean traffic through.
- Create a disaster recovery plan covering communication, mitigation and recovery.
- Strengthen the security of your own internet connected devices so they cannot be recruited: antivirus, a firewall limiting inbound and outbound traffic, and good security habits.
It lists symptoms that might indicate an attack: unusually slow network performance, a particular website unavailable, or inability to access any website. These resemble ordinary faults, so network traffic monitoring and analysis, via a firewall or intrusion detection system, is the best way to identify it.
How to check or apply this
- Know your baseline. Record normal traffic, connections and request rates per service.
- Set rate limits and size limits at the edge and per API client, including on costly operations.
- Learn how your provider's DoS protection works and what you must configure to use it.
- Write a runbook: who declares an incident, who calls the provider, who updates customers, and what to degrade first.
- Remove single points of failure, and test failover.
- Check that your own devices do not use default passwords.
- Rehearse once a year with a tabletop exercise.
Quick check
What is the difference between DoS and DDoS?
A DoS attack comes from one source or a few. A DDoS attack uses many machines, often a botnet, which raises volume and makes the source harder to trace.
Can a small number of requests cause denial of service?
Yes. If each request is expensive, such as a heavy query, a few clients can exhaust resources. Limits on size, rate and cost per request help.
Sources
Last reviewed: 18 October 2026.
