What Is a DDoS Attack and How Do Hosts Mitigate It?

If you run a website, you have probably heard the term “DDoS attack” used as shorthand for “the site went down.” That is not quite accurate. A Distributed Denial of Service (DDoS) attack is a specific, deliberate technique for overwhelming a server, service, or network so that legitimate visitors cannot get through. Understanding how it actually works helps you make sense of what hosts and security services are protecting you from, and why.

What makes an attack “distributed”

A denial of service attack from a single source is fairly easy to block: identify the source IP address and drop its traffic. A distributed denial of service attack instead uses many machines at once, often thousands, frequently without their owners’ knowledge. These machines form what is known as a botnet, made up of compromised computers, routers, or Internet of Things devices such as cameras and DVRs. Because the traffic arrives from thousands of different addresses spread across the world, simply blocking a single IP achieves nothing.

The three main types of DDoS attack

DDoS attacks are generally grouped into three categories, based on which part of the network stack they target.

• Volumetric attacks aim to saturate the available bandwidth to a target by flooding it with as much traffic as possible. Common examples include UDP floods, DNS amplification, and NTP amplification, where an attacker sends small requests to misconfigured servers that reply with much larger responses directed at the victim. These attacks are measured in bits per second and can reach into the terabits per second range for the largest recorded incidents.
• Protocol attacks target the way connections are established and maintained rather than raw bandwidth. A classic example is a TCP SYN flood, where an attacker sends a stream of connection requests but never completes the handshake, tying up the resources of firewalls, load balancers, or servers that are waiting for a reply that never comes.
• Application-layer attacks (sometimes called Layer 7 attacks) target the web application itself, for example by repeatedly requesting a resource-intensive page such as a search function or a login form. These attacks use comparatively low traffic volumes made up of requests that look legitimate, which makes them harder to spot than a volumetric flood.

DDoS attack versus a genuine traffic spike

A sudden surge in visitors, say, after a product goes viral or a press mention lands, can look superficially similar to an attack: response times climb and the server struggles to keep up. The difference lies in the pattern of the traffic. Genuine visitors tend to arrive from a geographically sensible spread of locations, behave like real browsers (loading images, CSS, and scripts alongside the page), and interact with a range of pages. Attack traffic is often generated by scripts rather than browsers, hits a narrow set of endpoints repeatedly, arrives at a rate no real audience could sustain, or comes from IP ranges with no obvious relationship to the site’s actual audience. Traffic analysis tools look at exactly these signals to tell the two apart.

How mitigation actually works

No single technique handles every type of DDoS attack, so mitigation generally combines several layers.

• Rate limiting caps the number of requests a single IP address or client can make within a given time window, which helps against application-layer attacks and smaller-scale abuse without affecting normal visitors.
• Traffic scrubbing routes incoming traffic through a dedicated facility, sometimes called a scrubbing centre, where it is analysed and filtered. Legitimate traffic is forwarded on to the origin server and malicious traffic is dropped before it ever reaches it.
• Anycast network absorption is a network design where the same IP address is advertised from many locations around the world simultaneously. Because a request is automatically routed to the nearest available location, attack traffic from a distributed botnet is spread thinly across many points of presence rather than concentrated on a single target, which massively increases the capacity needed to have any effect.
• CDN and WAF layering puts a content delivery network and a web application firewall in front of the origin server. The CDN absorbs and caches traffic at the edge, reducing what actually reaches the backend, while the WAF inspects requests for malicious patterns at the application layer, catching the more targeted Layer 7 attacks that pure bandwidth defences miss.

These layers work together rather than in isolation. A large-scale volumetric flood is best dealt with through anycast absorption and scrubbing at the network edge, while a slow, deliberate application-layer attack needs the closer inspection a WAF and rate limiting can provide.

Summary

A DDoS attack is a deliberate attempt to knock a service offline by overwhelming it with traffic from many sources at once, whether by saturating bandwidth, exhausting connection resources, or hammering the application layer with requests that look legitimate. It differs from an organic traffic spike in its pattern and origin rather than its raw size. Effective mitigation is layered: rate limiting for abusive request patterns, scrubbing centres and anycast networks to absorb volume at scale, and CDN or WAF protection to filter out the more targeted application-layer attempts. No hosting provider or security vendor should claim a single tool solves the whole problem, because DDoS attacks themselves come in fundamentally different forms.