What Is a DDoS Attack? A Simple Explanation of Distributed Denial of Service

What Is a DDoS Attack?

 

Imagine that you run an online store. Your entire website is hosted on a server that can comfortably process around 2,000 requests per second.

Under normal circumstances, that might be enough. Real customers visit your website, browse products, add items to their carts, log in, and place orders. Each action creates requests that your server needs to process.

Now imagine someone sends 5,000 requests every second to your server.

Your server can handle only 2,000 requests per second, but it is suddenly receiving more than twice that amount. The server has to spend its resources processing incoming traffic, and eventually it becomes overloaded.

As a result, legitimate customers may experience slow loading times, failed connections, or a website that is completely unavailable.

This is the basic idea behind a Denial of Service, or DoS, attack.

The attacker is essentially trying to make your service unavailable to legitimate users by overwhelming the resources that the service depends on.

 

From DoS to DDoS

 

A simple DoS attack can come from a single computer.

For example, an attacker could write a program that repeatedly sends requests to your website. If that computer sends more requests than your server can handle, it may consume enough of your server's resources to affect legitimate users.

This type of attack is relatively straightforward to understand.

If every malicious request comes from the same IP address, you could potentially block that IP address. You could also introduce rate limits. For example, your system might detect that a particular IP address is making an unusually large number of requests and temporarily restrict it.

But what happens when the traffic isn't coming from one computer?

That's where Distributed Denial of Service, or DDoS, comes in.

Instead of sending traffic from one machine, a DDoS attack can involve thousands of different devices. These devices might include compromised computers, routers, cameras, servers, and other internet-connected equipment.

Together, these compromised devices can form what is commonly called a botnet.

The attacker can then use the botnet to generate traffic toward the target.

Instead of your server seeing something like this:

Computer A → Your Server

you might have a situation more like this:

Computer A → Your Server
Router B → Your Server
Camera C → Your Server
Laptop D → Your Server
Server E → Your Server
Thousands of other devices → Your Server

This makes the problem much more difficult.

 

Why Can't You Just Block the IP Addresses?

 

With a basic DoS attack, blocking the attacker's IP address may be enough to stop the attack.

With a DDoS attack, however, there may be hundreds, thousands, or even millions of source IP addresses involved.

Blocking every source address isn't necessarily practical.

There is another problem: some of those addresses may belong to legitimate users.

For example, imagine an online store suddenly receives traffic from 50,000 different IP addresses. Some of that traffic could be malicious, but some could be genuine customers trying to shop.

If you simply block all of those addresses, you could end up blocking legitimate customers along with the attackers.

That's why DDoS protection isn't simply a matter of maintaining a giant list of bad IP addresses.

Modern protection systems look at traffic patterns and other characteristics to distinguish normal traffic from suspicious or abusive traffic.

 

How Does a SYN Flood Work?

 

One common type of DDoS attack targets the process used to establish TCP connections.

To understand this, you first need to know a little about TCP.

When a client wants to establish a TCP connection with a server, the process begins with a SYN packet. The server responds with a SYN-ACK, and the client normally completes the process with an ACK.

This is commonly referred to as the TCP three-way handshake.

A simplified version looks like this:

Client: SYN
Server: SYN-ACK
Client: ACK

Once the handshake is completed, the connection can be used for communication.

A SYN flood takes advantage of the resources a server needs to handle connection attempts.

An attacker can send a large number of SYN packets to the server. The server may respond and temporarily keep track of those connection attempts while waiting for the rest of the handshake.

If the attacker sends enough requests, the server's available connection resources can become exhausted.

Imagine that your server can keep track of 2,000 connection attempts at a particular time. If an attacker manages to fill those available resources with a huge number of incomplete connection attempts, legitimate customers may have difficulty establishing connections.

In a real-world attack, the situation can be considerably more complicated than this simple example, and modern operating systems and network infrastructure have protections against SYN floods. Nevertheless, the example illustrates the basic concept: an attacker attempts to consume a limited server or network resource so that legitimate users cannot use it.

 

DDoS Attacks Don't Always Look Like Huge Request Counts

 

It's tempting to think that a DDoS attack is simply someone sending as many HTTP requests as possible.

That's one form of attack, but DDoS attacks can target different layers and resources.

Some attacks attempt to overwhelm a web server with application requests. Others target network bandwidth. Some attempt to exhaust connection or state-tracking resources.

This distinction is important because a server can have plenty of CPU power and still be affected by an attack that consumes its available network capacity.

For example, suppose your website server can process millions of requests efficiently, but the internet connection leading to your infrastructure can handle only a certain amount of traffic.

If an attacker sends more traffic than that connection can carry, the traffic can become a problem before it even reaches the application server.

That's one reason DDoS protection often needs to operate outside the individual web server.

 

How Do Companies Protect Against DDoS Attacks?

 

Companies generally use multiple layers of protection rather than relying on a single rule.

One common approach is to place a DDoS protection service or content delivery network (CDN) in front of the website.

Services such as Cloudflare can sit between visitors and the origin server.

Instead of every visitor connecting directly to your server, traffic first passes through the protection network. The system can analyze incoming traffic and apply different mitigation techniques when it detects an attack.

This is particularly useful because large DDoS protection networks have significantly more network capacity than a typical individual website server.

Suspicious traffic can be filtered before it reaches the origin server, while legitimate traffic can continue toward the website.

Other defensive techniques can include rate limiting, traffic filtering, firewalls, load balancing, connection management, caching, and specialized DDoS mitigation systems.

 

Why DDoS Protection Matters

 

For an online business, availability is extremely important.

If customers cannot access your website, they cannot browse products, place orders, log in, or use your services.

A DDoS attack doesn't necessarily have to break into a server or steal information to cause serious damage. Its goal can simply be to make the service unavailable.

That's what makes DDoS attacks different from many other types of cyberattacks.

The attacker isn't necessarily trying to gain access to your database. Instead, the attacker is trying to consume the resources that your legitimate users need.

 

The Simple Way to Think About DDoS

 

The easiest way to understand a DDoS attack is to imagine a small shop with one entrance.

The shop can comfortably serve 20 customers at a time. Suddenly, thousands of people crowd around the entrance and prevent genuine customers from getting inside.

The shop itself might still be functioning perfectly. The problem is that the entrance and available resources are being overwhelmed.

A DDoS attack works on a similar principle, except the target is a digital service.

A server has a finite amount of bandwidth, processing power, memory, connection capacity, and other resources. If an attacker can consume enough of those resources, legitimate users can be denied access.

That's why the name Distributed Denial of Service makes sense.

Distributed means the attack can originate from many different devices or locations.

Denial of service means the ultimate effect is preventing legitimate users from accessing the service normally.

The basic idea is simple, but defending against large-scale attacks can be a complex engineering problem. Modern websites therefore often use several layers of protection to detect abnormal traffic, absorb large volumes of requests, filter malicious traffic, and keep legitimate customers connected to the service.

In other words, the goal of DDoS protection isn't simply to stop every request. It is to separate the traffic that represents real users from traffic that is attempting to overwhelm the service—and to do that before the attack can consume the resources needed by legitimate customers.