What Is a DDoS Attack? How It Works and How to Stop It

A DDoS attack — distributed denial of service — floods a target with more traffic or requests than it can handle, using many machines at once, until legitimate users can’t get through. Unlike a simple denial-of-service attack from a single source, a DDoS attack is distributed: the traffic arrives from hundreds, thousands, or millions of different addresses simultaneously, which makes it far harder to block by simply filtering one IP.

The goal usually isn’t to breach anything. It’s to exhaust a resource — bandwidth, connection slots, CPU, or an application’s ability to process requests — so the service becomes slow or unreachable for everyone else.

How the “distributed” part works

A single machine sending traffic can be blocked at the network edge in seconds. Distribution is what makes DDoS attacks hard: the traffic looks like it’s coming from real, distinct clients scattered across the internet.

Most large-scale attacks draw on a botnet — a large number of compromised devices (servers, IoT devices, routers, even smart cameras) that have been infected with malware and can be remotely commanded to send traffic on cue. The device owners typically have no idea their hardware is participating. Because the requests originate from thousands of legitimate-looking IP addresses, distinguishing attack traffic from real users becomes a pattern-matching problem, not a simple blocklist problem.

The three broad categories

DDoS attacks generally fall into three layers of the network stack:

• Volumetric attacks aim to saturate bandwidth. UDP floods and amplification attacks (where a small spoofed request tricks a third-party server into sending a much larger reply to the victim) are the classic examples. These are measured in bits per second — the goal is simply to fill the pipe.
• Protocol attacks exploit weaknesses in how servers manage connections rather than raw bandwidth. A SYN flood, for instance, opens huge numbers of half-finished TCP handshakes and lets them hang, exhausting the connection table on the target server. These are measured in packets per second.
• Application-layer attacks target the application itself, often mimicking legitimate traffic — repeated HTTP requests to an expensive endpoint like a search page or login form, for example. These are measured in requests per second and are usually the hardest to distinguish from genuine load, since each individual request can look completely valid.

A sophisticated attack often blends all three, shifting tactics as defenses adapt.

Why DDoS attacks are hard to stop at the door

Traditional firewalls filter based on known-bad signatures or IP addresses. DDoS traffic defeats that approach in two ways: the sheer volume can saturate the link before any filtering logic runs, and the traffic’s diversity means there’s no single address or pattern to block. Blocking too aggressively also risks turning away real users, which is functionally the same outcome the attacker wanted.

This is why DDoS mitigation happens “upstream,” closer to the internet backbone, rather than at the target server itself. By the time traffic reaches a single origin server, the damage from a volumetric flood is often already done.

How mitigation actually works

Modern DDoS defense relies on a few complementary techniques:

• Traffic scrubbing. Providers route incoming traffic through a distributed network of scrubbing centers with far more aggregate bandwidth than any single origin server, absorbing volumetric floods before they reach the target. A CDN sitting in front of an origin server does this implicitly, since its edge network has enormous spare capacity compared to any one customer’s infrastructure.
• Rate limiting. Capping how many requests a single client (or client fingerprint) can make in a given window blunts application-layer floods without necessarily blocking anyone outright. See our guide to rate limiting for the algorithms behind this.
• Anycast routing. Announcing the same IP address from many geographically distributed points lets incoming traffic — including attack traffic — get absorbed and spread across dozens of data centers instead of converging on one location.
• Behavioral filtering and challenges. Distinguishing bots from humans using request patterns, TLS fingerprints, or interactive challenges, rather than static IP lists, is what a WAF typically layers on top of network-level scrubbing for application-layer attacks.
• Load balancers and autoscaling. Spreading requests across many backend instances, and adding more instances under load, raises the bar for how much traffic it takes to cause real degradation. See how load balancers distribute traffic across a server fleet.

None of these are silver bullets on their own — real-world DDoS protection is layered, combining upstream scrubbing with edge rate limiting and origin-side redundancy.

DDoS vs a legitimate traffic spike

Both can look identical at first: a sudden surge of requests overwhelming a server. The difference is intent and pattern. A traffic spike from a viral link or product launch tends to come from a geographically and behaviorally realistic distribution of users, each following a normal browsing pattern. Attack traffic tends to cluster — identical request patterns, unusual header combinations, disproportionate traffic from data-center IP ranges rather than residential ones, or requests hitting the single most expensive endpoint on a site rather than a natural mix of pages. Good mitigation systems build a baseline of normal traffic and flag deviations from it, rather than reacting to volume alone.

What operators can do proactively

Beyond relying on a CDN or dedicated mitigation service, a few practices reduce exposure:

• Put expensive endpoints (search, login, password reset) behind stricter rate limits than static content.
• Use a reverse proxy or CDN in front of origin servers so the origin’s real IP address is never exposed directly to the internet.
• Design for graceful degradation — caching, queueing, and circuit breakers that shed load predictably rather than crashing outright under pressure.
• Keep infrastructure capacity monitored so autoscaling and alerting trigger well before a spike becomes an outage.

The takeaway

A DDoS attack works by overwhelming a target with traffic from many distributed sources at once, which defeats simple IP-based blocking and forces defenses to operate upstream, at scale, and on behavioral patterns rather than static rules. Volumetric, protocol, and application-layer attacks each target a different layer of the stack, and real mitigation combines traffic scrubbing, rate limiting, anycast routing, and behavioral filtering rather than any single technique. For most teams, the practical answer is sitting behind a CDN or dedicated mitigation provider with far more absorptive capacity than any single origin server could have on its own.