Volumetric attack

A volumetric attack is a form of DDoS in which the attacker sets out to exhaust the entire bandwidth of the link leading to the victim. Rather than hunting for a software flaw, the attacker simply floods the target with so many packets and bytes that legitimate traffic no longer fits on the wire — the service becomes unreachable even though the server itself is still running. The intensity of such an attack is measured in gigabits or terabits per second.

How a volumetric attack works

The central technique is amplification. The attacker sends small queries to publicly exposed, misconfigured servers — DNS, NTP, memcached or CLDAP — while spoofing the victim's IP address as the source. Those servers reply with a much larger packet aimed straight at the target. This lets a botnet with modest uplink capacity generate a torrent of traffic many times its own size. Common vectors include DNS reflection, NTP amplification (the monlist request) and the exceptionally high-yield memcached reflection.

The second pillar is distribution: the flood originates from thousands of compromised devices scattered worldwide, which makes simple source-based blocking useless. The combined stream can overwhelm the capacity of even a well-provisioned data centre.

Practical application

Defence against volumetric attacks relies on filtering traffic before it reaches the victim's infrastructure. Operators run scrubbing centres — nodes where suspicious traffic is inspected and discarded, forwarding only clean packets onward. A distributed CDN absorbs part of the blow across dozens of points of presence, and a load balancer spreads the residual load across many nodes. When choosing hosting or a VPS, it is worth confirming that the provider offers built-in anti-DDoS scrubbing with adequate filtering capacity. Basic hygiene helps too: closing open DNS resolvers and NTP services so your own servers never become an unwitting amplifier, and keeping bandwidth headroom for sudden spikes.