DDoS Attacks: Types, Techniques, and Mitigations

A Distributed Denial of Service (DDoS) attack attempts to make a service unavailable by overwhelming it with traffic or requests from many sources at once. DDoS attacks matter because availability is a core security property, and even well-secured systems fail if legitimate users cannot reach them. This article breaks down the main categories of attack by the layer they target and explains the mitigations that keep services resilient.

What a DDoS Attack Is

A denial of service attack seeks to exhaust a finite resource: bandwidth, connection state, CPU, memory, or an application's capacity to process requests. The distributed qualifier means the traffic originates from many machines simultaneously, which both multiplies the volume and makes simple source-blocking ineffective.

Attacks are commonly grouped into three families based on what they exhaust:

• Volumetric attacks saturate network bandwidth.
• Protocol attacks exhaust connection state or other protocol resources.
• Application-layer attacks overwhelm the logic of a specific service.

Volumetric Attacks

Volumetric attacks aim to fill the target's inbound bandwidth so that legitimate packets cannot get through. They are measured in bits per second and rely on sheer scale. The attacker's challenge is generating enough traffic, which is frequently solved with amplification.

Amplification and Reflection

Amplification exploits protocols where a small request produces a large response. In a reflection attack, the attacker sends requests to third-party servers with the source address spoofed to the victim's address. The servers dutifully send their large responses to the victim, who never asked for them. Protocols with a high response-to-request size ratio, such as certain DNS and NTP queries, make especially potent amplifiers.

The mechanics are:

1. The attacker spoofs the victim's IP as the source of many small requests.
2. Requests go to open, misconfigured reflectors.
3. Reflectors send disproportionately large replies to the victim.
4. The combined replies saturate the victim's link.

This is one reason source address validation across the internet, which blocks spoofed packets, is an important collective defense.

Protocol Attacks

Protocol attacks target the state that network devices and servers must keep. The classic example is the SYN flood, which abuses the TCP handshake. The attacker sends many SYN packets to open connections but never completes the handshake, leaving the server holding half-open connections until its connection table fills and legitimate clients are refused.

Because these attacks consume connection state rather than raw bandwidth, a comparatively modest packet rate can exhaust a server or a stateful device such as a firewall or load balancer. SYN cookies, which let a server avoid storing state until a handshake completes, are a standard countermeasure.

Application-Layer Attacks

Application-layer attacks target the service itself with requests that appear legitimate but are expensive to process. An example is a flood of HTTP requests to a page that triggers heavy database queries. Because each request may look normal, these attacks can use far less bandwidth than volumetric floods while still overwhelming the application.

These attacks are harder to distinguish from real traffic, so mitigation relies on behavioral analysis, rate limiting per client, and challenges that separate humans from automated clients. An intrusion prevention system or web application firewall can help identify abusive patterns.

How Attacks Are Launched

Large attacks are typically driven by botnets: networks of compromised devices, including servers, home routers, and Internet of Things gadgets, under a single operator's control. The operator commands the botnet to direct traffic at a target on cue. Because the traffic comes from many genuine, if hijacked, devices around the world, blocking individual sources is impractical, which is precisely what makes the distributed model effective.

Mitigating DDoS Attacks

No single control stops every attack; resilience comes from layers:

• Overprovisioning and elasticity provide headroom to absorb spikes and scale under load.
• Upstream scrubbing routes traffic through providers that filter malicious packets before they reach you, essential for volumetric floods that would otherwise saturate your link.
• Anycast distribution spreads incoming traffic across many geographic locations, diluting an attack.
• Rate limiting and connection controls cap how much any single source can consume.
• Stateless defenses such as SYN cookies protect against state-exhaustion attacks.
• Application-aware filtering and behavioral analysis catch layer-7 abuse that looks superficially valid.

A basic per-source connection limit on a Linux host illustrates the rate-limiting principle:

iptables -A INPUT -p tcp --syn --dport 443 -m connlimit --connlimit-above 20 -j DROP

This alone will not stop a large distributed attack, which is why upstream, provider-scale mitigation is central for serious threats. Combining these controls with sound network segmentation limits collateral damage when one service is targeted.

Key Takeaways

• DDoS attacks exhaust a finite resource using traffic from many distributed sources at once.
• Volumetric attacks saturate bandwidth, often amplified by reflecting off misconfigured third-party servers.
• Protocol attacks like SYN floods exhaust connection state, while application-layer attacks overwhelm service logic with plausible requests.
• Botnets of compromised devices supply the distributed firepower, making source-blocking impractical.
• Effective mitigation layers overprovisioning, upstream scrubbing, anycast, rate limiting, and application-aware filtering.