DoS vs DDoS: what is the difference and why does it matter?

A denial-of-service (DoS) attack comes from one source, while a distributed denial-of-service (DDoS) attack comes from many. The goal is the same: make a service unavailable. The difference decides your defense. One source can be blocked. Thousands cannot, so you filter traffic and absorb load.

What counts as a DoS attack?

CISA describes a DoS as a condition where legitimate users cannot reach information systems, devices or other network resources because of a malicious actor's actions. The usual method is flooding the target with traffic until it cannot respond or crashes.

Two classic forms appear in CISA's explainer. In a Smurf attack, the attacker sends ICMP broadcast packets with a spoofed source address belonging to the victim, so many hosts reply to the victim at once. In a SYN flood, the attacker starts TCP connections but never finishes the three-way handshake, leaving ports occupied.

RFC 4987 describes SYN flooding and the trade-offs of each countermeasure, and says it makes no standards-level recommendations.

What makes a DDoS different?

Scale and spread. NIST defines it as a DoS technique using numerous hosts. CISA notes botnets of hijacked devices carry out large attacks, and that the effect can be exponentially more requests than one machine can send.

Two practical consequences follow. First, the sources look like ordinary users from ordinary places, so allow and block lists by address stop little. Second, your own bandwidth is the limit. If the link is full, no firewall rule on your side helps, because the traffic has already crossed the link.

Side by side

Where does ingress filtering come in?

Many floods use forged source addresses. RFC 2827 describes ingress traffic filtering, where a provider drops packets that leave a customer network with a source address that network does not own. It does not stop attacks, but it stops one way of hiding. It is done by network operators, so your lever is choosing providers that do it and asking.

How do reflection and amplification fit in?

Some attacks send small requests with the victim's forged address to servers that reply with much larger answers. The Smurf attack in CISA's description is the classic example: one forged broadcast, many replies landing on the target. The attacker needs little bandwidth, and the victim receives a flood from innocent third parties.

This is why the single-source versus many-source split is a simplification. A single attacker using reflection can look like a distributed attack from the victim's side, because the traffic arrives from many addresses. For defense, the distinction that matters is where you can cut the traffic, not how many machines the attacker owns.

How to check or apply this

1. Identify which category a given event falls into. Look at source count and spread in your logs.
2. For a single noisy source, block it at the edge and fix the weakness it used, for example enable SYN protection on the servers you run.
3. For many sources, call your provider early. Upstream filtering works before the traffic reaches your link.
4. Rate limit expensive routes regardless of category.
5. Keep contacts for your provider's abuse and DDoS desks in the runbook.
6. Review the 2024 CISA, FBI and MS-ISAC guide for the volumetric, protocol and application split.

A mistake to avoid is assuming the label from the symptom. A slow site can be a DoS, a DDoS, a bad deploy or a viral post. Check the logs before you escalate.

Quick check

Sources

• CISA: Understanding Denial-of-Service Attacks
• CISA: Understanding and Responding to DDoS Attacks (2024)
• RFC 4987: TCP SYN Flooding Attacks and Common Mitigations
• RFC 2827: Network Ingress Filtering

Last reviewed: 18 October 2026.