What is DDoS (Distributed Denial of Service)?
Updated: 3 days ago
A DDoS, or Distributed Denial of Service, attack is an attempt to make an online service, network or application unavailable by overwhelming a finite resource with traffic or requests from numerous sources. The important word is distributed: unlike a basic denial-of-service attack from one source, a DDoS attack can involve many compromised devices or systems sending traffic at the same target.
A DDoS attack is primarily an attack on availability. It can consume internet bandwidth, connection state, firewall or load-balancer capacity, server resources, or application capacity. An outage caused by DDoS does not by itself prove that data was stolen or that the target was breached.
How does a DDoS attack work?
Every online service has finite capacity somewhere in its path. That limit might be the broadband or transit connection, a router or firewall, a table that tracks active connections, CPU or memory on a server, database capacity, or the amount of work an application can perform at once.
During a DDoS attack, many sources generate enough unwanted traffic or expensive requests to consume one or more of those constrained resources. Legitimate users then compete for what remains. Their requests may become slow, time out or fail completely.
NIST defines distributed denial of service as a denial-of-service technique that uses numerous hosts to perform the attack. NIST's DDoS glossary is a useful concise reference for that distinction.
DDoS vs DoS: what is the difference?
DoS: denial of service. A service is deliberately disrupted or made unavailable, potentially from a single source or a small number of sources.
DDoS: distributed denial of service. Numerous hosts or sources participate in the attack, often making simple source blocking less effective.
Both target availability: the practical outcome can be similar for the user, even though the source and scale of the traffic differ.
Distribution matters because blocking one address may remove only a tiny part of the unwanted traffic. A large attack may also arrive through many networks and geographic locations, while application-layer traffic can resemble legitimate requests.
What are the main types of DDoS attack?
Volumetric attacks
Volumetric attacks try to consume available network capacity with a very large amount of traffic. If the incoming attack exceeds the capacity of the constrained link, filtering only after that link does not restore the lost capacity. Mitigation therefore often needs to happen upstream, before the bottleneck.
Protocol and state-exhaustion attacks
Some attacks focus on network and transport-layer behaviour, consuming resources in firewalls, load balancers, servers or connection-tracking systems. SYN floods are a familiar example of traffic that can target TCP connection state.
Application-layer attacks
Application-layer, or Layer 7, attacks target the work an application performs. A request can look superficially legitimate while causing the server, API, database or another backend component to do substantial processing. That means a disruptive application-layer attack does not necessarily need the enormous bandwidth associated with a volumetric flood.
Cloudflare's technical overview separates DDoS into volumetric, protocol and application-layer categories and explains why Layer 7 requests can exhaust server resources. See Cloudflare's DDoS overview.
What is a botnet and why is it associated with DDoS?
A botnet is a group of compromised or otherwise controlled devices that can be instructed to act together. In a DDoS attack, a botnet can provide the distributed sources that send traffic towards a victim. The participating devices can include computers, servers and internet-connected equipment.
The existence of many source addresses does not automatically prove that every DDoS attack is a botnet attack. Distributed traffic can be produced in different ways, including reflection and amplification techniques that cause third-party systems to send responses towards a victim.
What are reflection and amplification attacks?
In a reflection attack, an attacker can abuse a service so that replies are directed towards the victim rather than back to the true originator. Where a small request produces a substantially larger response, the technique can also amplify traffic. The result is that the victim receives more traffic than the attacker had to send directly.
This is one reason source-address validation and correctly configured internet services matter. It is also why DDoS mitigation is an ecosystem problem rather than something that can always be solved by changing a setting on the target server.
What happens to your broadband connection during a DDoS attack?
For a home or small-business connection, the critical distinction is where the bottleneck occurs. If attack traffic saturates the access link before your router can discard it, a local firewall rule cannot recover the capacity already consumed on that link.
For example, imagine a service behind a 1 Gbps downstream connection receives 1.5 Gbps of unwanted traffic at the constrained point. Techie Broadband calculation: demand is 150% of that 1 Gbps capacity. Even a perfectly configured local firewall cannot make the access link carry 1.5 Gbps without congestion. Upstream filtering is required to prevent the excess traffic reaching that bottleneck.
This example is deliberately theoretical. Real DDoS behaviour depends on packet sizes, protocol overhead, provider architecture, routing, mitigation, device packet-processing limits and the actual location of the constrained resource.
Can CGNAT or a dynamic IP address stop DDoS?
No single addressing arrangement should be treated as DDoS protection. NAT, CGNAT and dynamic addressing can change how inbound connectivity works, but they do not provide a general guarantee against denial-of-service traffic directed at reachable services, shared infrastructure or provider resources.
If you are trying to understand the addressing side, see What is IPv4? and What is IPv6?. The important point is that DDoS resilience is about protecting finite resources, not simply whether an address is static, dynamic, translated or native.
DDoS, firewall, IDS and IPS are not the same thing
Firewall: applies traffic policy and can allow, reject or drop traffic according to configured rules and state.
IDS: an Intrusion Detection System monitors activity and generates detections or alerts when behaviour appears suspicious.
IPS: an Intrusion Prevention System can operate inline and attempt to block or reject traffic that matches prevention logic.
DDoS mitigation: focuses specifically on maintaining availability by detecting and handling denial-of-service traffic at sufficient scale and at the right point in the network.
These controls can overlap in modern platforms, but the concepts remain distinct. See What is IDS (Intrusion Detection System)?, What is IPS (Intrusion Prevention System)? and What is Packet Inspection? for the related traffic-analysis concepts.
How is a DDoS attack mitigated?
There is no single universal DDoS filter. Effective mitigation depends on the attack vector and the resource being exhausted. The central objective is to distinguish legitimate from unwanted traffic early enough, and at enough scale, to preserve capacity for real users.
Upstream filtering: discard unwanted traffic before it crosses the target's constrained access link.
Rate limiting: restrict excessive traffic or request rates where doing so does not block legitimate demand.
Anycast and distributed infrastructure: spread traffic across multiple network locations and increase the capacity available to absorb an attack.
Web application filtering: identify unwanted Layer 7 request patterns before they consume origin resources.
Caching and resilient architecture: reduce the amount of work that every request forces the origin to perform.
Capacity and redundancy: provide headroom and alternative paths, while recognising that capacity alone is not a substitute for detection and filtering.
CISA's joint guidance on understanding and responding to DDoS attacks recommends proactive preparation to reduce impact. Read the CISA DDoS guidance.
Why can blocking the attack on your own router be too late?
A router can only process traffic that has already reached it. If the internet-facing circuit is the resource being overwhelmed, dropping packets at the customer router happens after the scarce access capacity has already been consumed. This is the same bottleneck principle that applies elsewhere in networking: protection needs to operate before the constrained resource whenever possible.
Network segmentation can still limit the effect of incidents inside an organisation, but it is not a substitute for upstream DDoS protection. See What is Network Segmentation?.
How can you tell whether an outage might be DDoS?
A slow or unreachable website does not prove a DDoS attack. Congestion, routing faults, DNS problems, application failures, server overload, maintenance and provider outages can produce similar symptoms. Diagnosis needs evidence from multiple points in the path.
Check whether the problem affects one service, several services or your entire internet connection.
Test from a second independent network, such as mobile data, to separate a local access problem from a remote service problem.
Check whether DNS resolution works and whether the destination address can be reached by other appropriate tests.
Inspect router, firewall, server and application monitoring for unusual traffic rates, connection counts, resource exhaustion or repeated request patterns.
Compare inbound traffic with your normal baseline rather than assuming every spike is malicious.
If your access circuit is saturated, contact the ISP or upstream provider because mitigation may need to occur before the traffic reaches you.
For a hosted website or application, use the hosting, CDN or DDoS provider's telemetry to identify which layer and resource is under pressure.
Do not deliberately reproduce suspected attack traffic as a diagnostic test against systems you do not own or have explicit permission to test. Normal troubleshooting should focus on telemetry, path isolation and authorised testing.
Does DDoS always mean a website has been hacked?
No. DDoS describes loss or degradation of availability. It does not automatically mean an attacker gained unauthorised access, executed code, read private data or altered the target. A DDoS incident can occur alongside another security incident, but the evidence for confidentiality or integrity compromise must be assessed separately.
DDoS and the UK broadband context
For UK broadband users, the practical impact depends on the complete service path: the remote service, transit and peering, the ISP network, the access network, the router and the local device. FTTP does not make a connection immune to DDoS. Faster broadband increases available access capacity, but an attack can target a different bottleneck or exceed that capacity.
Businesses hosting internet-facing services should understand who can provide upstream mitigation and what happens when attack traffic exceeds the capacity of their own circuit. For cloud-hosted applications, the relevant controls may sit with the cloud, CDN, hosting or security provider rather than the office broadband router.
Common DDoS misconceptions
A DDoS attack must use huge bandwidth: false. Application-layer attacks can exhaust expensive application resources at much lower traffic volumes.
An open port means you are being DDoSed: false. An open port only indicates that a service appears reachable. See What is Port Scanning? for the distinction.
A firewall always stops DDoS: false. A firewall can itself become a constrained resource, and local filtering cannot restore an already saturated upstream link.
DDoS automatically means data was stolen: false. DDoS is primarily about availability.
More broadband speed guarantees protection: false. More capacity can increase headroom, but attacks and bottlenecks vary.
For the separate concept of testing reachable ports, see What is Port Scanning?.
Key takeaway
A DDoS attack uses distributed traffic or requests to exhaust a finite resource and deny legitimate users normal access. The resource under pressure might be bandwidth, network state, server capacity or application processing. Effective defence therefore depends on identifying the real bottleneck and mitigating unwanted traffic before that bottleneck is exhausted.
Frequently asked questions
What does DDoS stand for?
DDoS stands for Distributed Denial of Service. It describes denial-of-service activity performed using numerous hosts or distributed sources.
What is the difference between DoS and DDoS?
DoS is the broader denial-of-service concept. DDoS is distributed across numerous hosts or sources, which can make simple source blocking and traffic handling more difficult.
Can a DDoS attack affect home broadband?
Yes, if unwanted traffic or another targeted resource causes the connection or service to become constrained. The impact depends on addressing, routing, provider architecture, mitigation and where the bottleneck occurs.
Can a firewall stop a DDoS attack?
A firewall can filter some unwanted traffic, but it is not a guarantee against DDoS. If the attack saturates an upstream link or exhausts the firewall itself, mitigation needs to happen earlier or at greater scale.
Is DDoS the same as hacking?
No. DDoS targets availability. Hacking is a broad informal term that can describe many kinds of unauthorised activity. A DDoS outage does not by itself prove that the attacker accessed or stole data.
To explore the related technical concepts used in this DDoS (Distributed Denial of Service) guide, visit our broadband terminology guide.
