DDoS

A DDoS attack (Distributed Denial of Service) aims to make a website, server, or entire network unavailable to legitimate users by flooding it with traffic from many sources at once. The distribution is the point: requests come from thousands or millions of compromised devices — PCs, servers, IP cameras, home routers — herded into a botnet under the attacker's control, which makes the flood both massive and hard to filter by origin.

How a DDoS attack works

Attacks fall into three broad classes:

• volumetric — saturating bandwidth with sheer packet volume, including reflection and amplification techniques where a small spoofed request to an open DNS or NTP server triggers a response many times larger, aimed at the victim;
• protocol — exhausting state on network gear and operating systems, the classic example being a SYN flood that fills the TCP half-open connection table;
• application-layer (L7) — mimicking real users while hammering computationally expensive HTTP endpoints such as search or login, which makes the traffic hard to distinguish from a genuine spike.

Modern attacks have exceeded terabits per second, and “DDoS-for-hire” services rent capacity for a few dollars — so targets include small online stores as often as large enterprises, frequently with a ransom demand attached.

Practical applications — building a defense

Effective protection is layered. At the network edge, upstream providers and anti-DDoS services divert traffic through scrubbing centers that drop malicious packets before they reach the origin. At the application layer, a CDN or reverse proxy absorbs and disperses load geographically, while a WAF and rate limiting throttle abusive request patterns. Within the infrastructure, load balancers, capacity headroom, and hardened kernel settings raise the cost of a successful attack. When choosing a hosting or VPS provider, network-level DDoS protection is worth verifying up front — mitigation improvised mid-attack is always slower and more expensive than defenses and an incident-response contact prepared in advance.