A distributed denial-of-service (DDoS) attack uses many machines, often a botnet of hijacked devices, to send a target more traffic or requests than it can handle, so legitimate users cannot reach it. The aim is unavailability, not theft. Defense is mostly about capacity, filtering and a rehearsed plan.
How does a DDoS attack work?
NIST's glossary defines a DDoS as a denial of service technique that uses numerous hosts to perform the attack. CISA adds the usual mechanism: attackers take advantage of security vulnerabilities or device weaknesses to control many devices through command and control software, then tell the botnet to hit one target. The infected devices are victims too.
Botnets can be rented. CISA notes that access is often sold through attack-for-hire services, which lets unskilled people launch attacks. That is why a small business can be hit by someone with a grudge and a few dollars.
What are the three types?
The 2024 joint guide from CISA, the FBI and MS-ISAC sorts DDoS techniques into three groups.
- Volumetric: consume the available bandwidth.
- Protocol: exploit weaknesses in network protocols, such as a half-open connection flood.
- Application: target a specific application or service, for instance an expensive search endpoint.
The groups call for different defenses. Extra bandwidth helps with the first and does little for the third, where a few thousand requests to a slow database query can do the damage.
What does it look like in practice?
A constructed example. A ticketing site sells tickets at noon. At 11:58 traffic triples, then keeps climbing. The load balancer is healthy, but the checkout service times out. Logs show most requests hit one URL that runs a heavy query, from thousands of addresses that never completed a purchase.
That is an application-layer attack. Adding servers would raise the bill without fixing the cause. The useful moves were rate limits on that route, caching, and a filter in front of the service that challenges clients with no session history.
How to check or apply this
- Know your normal. Record typical request rates per route so a spike is visible in minutes.
- Find your expensive endpoints: search, login, report export. Put limits and caches there first.
- Put a scrubbing or filtering service, or your provider's DDoS protection, in front of public services. Confirm it covers application traffic as well as volume.
- Keep spare capacity and autoscaling limits you have actually tested.
- Write the response plan: who calls the provider, who talks to customers, who can change firewall rules at 3 a.m.
- Remember that your provider can be the target. CISA notes your network can lose service if your ISP or cloud provider is attacked.
- After an event, record what worked and fix the slowest step.
Practice the plan. A runbook nobody has run is a guess.
What does it cost, and who is a target?
CISA says denial-of-service attacks can cost an organization both time and money while resources and services are inaccessible. The direct cost is lost sales or missed service commitments. The indirect cost is staff time during the event and the trust lost with users who could not get through.
Anyone with a public service can be a target: shops, schools, game servers, government portals, small APIs. Motives vary. Some attackers want payment to stop, some want attention, some are testing tools. Do not assume that being small makes you invisible, because botnets scan broadly and rented attacks are cheap.
Plan for the quiet version as well. A low-rate application attack can run for hours and look like a slow day until support tickets arrive. Alert on error rate and latency per route, not just on total traffic.
Is a DDoS attack a breach?
Not by itself. It denies availability and does not give the attacker access to your data. Still, a flood can be used as a distraction, so check your logs for other activity during the event rather than assuming nothing else happened.
Quick check
Can I stop a DDoS attack by blocking one IP address?
No. The traffic comes from many sources, and blocking addresses one by one rarely keeps up. You need filtering and capacity that work in aggregate.
Who should I report a DDoS attack to?
Your service or cloud provider first, since they can often filter upstream. In the United States, CISA and the FBI accept reports of incidents. Elsewhere, use your national CERT.
Sources
- CISA: Understanding Denial-of-Service Attacks
- CISA: Understanding and Responding to Distributed Denial-of-Service Attacks (2024)
- NIST CSRC glossary: Distributed Denial of Service
Last reviewed: 18 October 2026.
