What Is a DDoS Attack and How Do Sites Defend?

TL;DR

• A DDoS (distributed denial-of-service) attack uses huge amounts of traffic from many devices to make a website or service unavailable to real users [1].
• The devices are often a botnet: ordinary gadgets infected with malware and controlled remotely.
• Defences are layered: filtering, rate limiting, spreading traffic across many servers, monitoring and a response plan [2].
• You can help by keeping your own devices updated and changing default passwords.

How a DDoS attack works #

Every server can only handle so many requests at once. A denial-of-service attack tries to use up that capacity so legitimate visitors cannot get through. When the traffic comes from many machines at once, it is a distributed attack. It is harder to block because there is no single source to shut out [1].

Picture a shop with one door. If a thousand people crowd the doorway with no intention of buying, genuine customers cannot get in. The shop itself is fine, it is just unreachable.

The devices doing the flooding are often part of a botnet, a group of compromised computers, cameras, routers or other internet-connected gadgets. Their owners usually do not know. This is why unsecured smart devices with default passwords matter [1].

The main types #

Security agencies group attacks by what they try to exhaust [2]:

Reasons given for attacks include extortion, activism, competition and revenge. Sometimes the flood is a distraction while something else is attempted, so owners should watch their other systems too [1][2].

How sites defend #

No single measure is enough, so organisations stack several [2]:

• Filtering and scrubbing. A protection service sits in front of the site, drops junk and forwards clean traffic [1].
• Rate limiting. Cap how many requests one address can make in a time window [2].
• Web application firewall (WAF). Filters harmful requests aimed at the application [2].
• Spreading the load. Distributing traffic across many locations, for example with a CDN or anycast routing, so no one server takes the full force [2][3].
• Monitoring. Know what normal traffic looks like so alerts fire when it spikes [2].
• A response plan. Written roles, contacts and steps, plus a call to the ISP or cloud provider [1][2].

Blackhole routing, which discards all traffic to a target, is a last resort because it also drops real visitors [2].

What you can do as an individual #

Keep software and antivirus up to date, change default passwords on routers and smart devices, and use a firewall. These steps make it less likely your devices get drafted into a botnet [1].

FAQ #

What is the difference between DoS and DDoS? #

A DoS attack comes from one source. A DDoS attack comes from many, which multiplies the traffic and makes it harder to trace and block [1].

How can I tell if a site is under attack? #

Signs include very slow performance or a site being unavailable, but these can also come from maintenance or technical faults. Monitoring traffic is the reliable way to tell [1].

Is a DDoS attack the same as hacking? #

Not exactly. A DDoS attack aims to knock a service offline, not to steal data. It can still be used alongside other attacks, which is why defenders keep watching other systems [1].

Can a CDN stop a DDoS attack? #

It can help, because it spreads traffic over many servers and can filter some of it. It is one layer of defence, not a complete answer [3].

Sources #