What a DDoS attack is

A DDoS (Distributed Denial of Service) attack is an intentional attempt to make a service unavailable by flooding it with traffic or requests. The goal is typically disruption rather than data theft. Because the traffic can come from many sources at once, defenders may struggle to distinguish harmful traffic from legitimate users.

DDoS attacks can target different layers of the communication path, such as:

  • Network/transport capacity (for example, consuming bandwidth or saturating links)
  • Server or application resources (for example, exhausting CPU, memory, connection limits, or request-handling capacity)
  • Specific behaviors or endpoints (for example, concentrating requests on login or search features)

How a DDoS attack works (in plain terms)

Most DDoS activity follows a similar logic:

  1. Traffic amplification or aggregation: Attackers use many devices (often compromised) or leverage mechanisms that increase the amount of traffic sent toward the target.
  2. Concurrency and rate pressure: Attack traffic is shaped so that the victim’s resources are strained—either by sheer volume, by many simultaneous connections, or by resource-heavy requests.
  3. Persistence and switching patterns: Attacks often adjust over time (rates, source mix, request patterns) to keep the service degraded and to reduce the effectiveness of simple blocking.

An important nuance is that availability impact is about resource exhaustion and service processing. If a service can absorb the incoming load—or if malicious traffic is filtered early enough—user impact may be minimal.

Differences and limits you should understand

Not every “spike in traffic” is a DDoS, and not every DDoS can be stopped perfectly. Key differences and limits include:

DDoS vs. legitimate demand

  • A flash crowd (marketing event, popular release, or viral link) can look similar to a DDoS.
  • Legitimate spikes usually align with normal user behavior patterns, while DDoS traffic may show unusual source distributions, repeated request patterns, or abnormal protocol/endpoint usage.

Network vs. application effects

  • Network-layer floods may saturate bandwidth and keep traffic from reaching application components.
  • Application-layer attacks may bypass raw bandwidth limits and instead consume CPU, database connections, caches, or thread pools.

Mitigation has boundaries

Common mitigations—such as rate limiting, request filtering, and capacity scaling—improve resilience, but they don’t guarantee full protection. Overly aggressive filtering can also block legitimate users, so defenses often need tuning and monitoring.

Uncertainty in detection

Without access to detailed traffic telemetry, you can’t know the attacker’s intent or sophistication with certainty. You can, however, assess whether behavior matches typical DDoS indicators and whether your defenses respond in a controlled way.

Practical checks: what you can verify

If you’re assessing whether you’re exposed to DDoS-style disruption, focus on observable indicators and operational readiness:

  • Monitor traffic and error patterns: Look for sudden increases in request volume, connection counts, timeouts, or elevated error rates that correlate with service degradation.
  • Break down by layer and endpoint: Check whether the pressure is at the network level (bandwidth saturation), transport level (connection churn), or application level (specific endpoints causing disproportionate CPU/latency).
  • Review filtering and rate controls: Confirm that rate limiting and allow/deny logic exist for relevant protocols and endpoints, and that they are configurable without disabling core functionality.
  • Assess “fail-soft” behavior: During high load, does the service shed non-critical work, use caching effectively, or degrade gracefully rather than collapsing completely?

Several terms commonly appear alongside DDoS, and they help clarify the bigger picture:

  • DoS: A denial-of-service attack from a single source (DDoS is distributed).
  • Botnet: A collection of compromised devices that can be used to generate attack traffic.
  • Rate limiting: A control that restricts how frequently requests can be made, helping contain abusive traffic.
  • WAF and filtering: Defensive layers that can block or challenge suspicious requests—especially at the application level.
  • Availability vs. integrity/confidentiality: DDoS mainly targets availability; it’s different from attacks that aim to alter data or steal secrets.