DDoS Attack Meaning & How It Takes Sites Offline

A Distributed Denial-of-Service (DDoS) attack is a cyberattack that floods a website, server, or network with so much junk traffic that it becomes unreachable for legitimate users. You enter nothing—this is an explanation, not a calculator—and what you get back is a clear understanding of how these attacks work, why they succeed, and what can be done about them. This article explains the mechanics, the common types, the real-world impact, and the practical defenses, so you can recognize an attack and know what steps to take if one hits your site.

What Exactly Is a DDoS Attack?

A DDoS attack is a deliberate attempt to make an online service unavailable by overwhelming it with traffic from many different sources. The word “distributed� is key: unlike a simple denial-of-service (DoS) attack, which comes from a single computer, a DDoS attack uses a network of compromised devices—often called a botnet—to send requests simultaneously. Because the traffic comes from thousands of different IP addresses, it is nearly impossible to block by simply banning one source.

The goal is not to steal data or break into a system. The goal is to exhaust one of three finite resources:

• Bandwidth – the amount of data the server’s internet connection can carry.
• Processing power – the CPU and memory needed to handle requests.
• Application resources – database connections, session states, or API calls that are expensive to create.

When any one of these is maxed out, the server can no longer respond to legitimate visitors. The attack succeeds not by exploiting a software bug, but by abusing the normal way the internet works.

How Does a DDoS Attack Actually Work?

To understand how a DDoS attack takes a site offline, you need to know a little about how web traffic flows. When you type a web address into your browser, your device sends a request to the server that hosts the site. The server processes that request and sends back the page data. This is a simple request-response cycle.

A DDoS attack floods that cycle with millions of requests per second. The server has to spend time and memory on each one, even if it eventually rejects it. Once the number of requests exceeds the server’s capacity, the queue backs up, and legitimate requests are either dropped or take so long that the page times out.

Attackers use several techniques to make each request as expensive as possible:

• SYN flood – sends a flood of “connection start� packets but never completes the handshake, causing the server to hold half-open connections until they time out.
• HTTP flood – sends seemingly legitimate GET or POST requests to a web page, forcing the server to generate a full response for each one.
• UDP flood – sends large numbers of User Datagram Protocol packets to random ports, making the server check each one and reply with an ICMP “destination unreachable� message.
• DNS amplification – sends small queries to open DNS servers with a spoofed victim IP address, causing the servers to send large responses to the victim, multiplying the traffic many times over.

These methods are often combined. A typical attack might start with a volumetric flood to saturate bandwidth, then follow with an application-layer attack to exhaust the server’s processing power.

What Are the Common Types of DDoS Attacks?

DDoS attacks are usually categorized by which layer of the network they target. The most common breakdown uses the OSI model, a seven-layer framework for network communication.

• Layer 3 (Network) attacks – target the routing infrastructure. Examples include ICMP floods (ping of death) and smurf attacks. These are mostly obsolete today because modern routers filter them.
• Layer 4 (Transport) attacks – target the TCP/UDP ports. SYN floods and UDP floods are classic examples. They aim to exhaust the server’s connection table.
• Layer 7 (Application) attacks – target the web application itself. HTTP floods and slowloris attacks (where the attacker sends partial requests and keeps the connection open) are common. These are the hardest to defend against because the traffic looks like a real user.

Volumetric attacks (measured in gigabits per second, or Gbps) aim to clog the pipe. Protocol attacks (measured in packets per second, or PPS) aim to crash the server’s ability to process connections. Application attacks (measured in requests per second, or RPS) aim to exhaust the server’s CPU and memory. A single large attack can combine all three.

How Do Attackers Build a Botnet?

To launch a distributed attack, an attacker needs a botnet—a network of compromised devices. These are not powerful servers; they are often ordinary home routers, webcams, smart TVs, and other Internet of Things (IoT) devices that have weak default passwords or unpatched vulnerabilities.

The process is straightforward:

1. The attacker scans the internet for devices with open ports or known vulnerabilities.
2. Malware is installed on the device, often silently, turning it into a “bot� that can receive commands.
3. The bots are grouped into a command-and-control (C&C) infrastructure.
4. When the attacker wants to launch an attack, they send a command to the C&C server, which instructs all bots to send traffic to the target simultaneously.

Because the bots are spread across the globe, the traffic appears to come from everywhere. This makes it nearly impossible to block by geographic region or by IP address. The Mirai botnet in 2016 is a well-known example: it infected hundreds of thousands of IoT devices and used them to launch massive attacks on DNS provider Dyn, taking down major websites for hours.

What Are the Real-World Consequences?

The most obvious effect is downtime: the website is unreachable. But the consequences go beyond a temporary error page.

• Revenue loss – for e-commerce sites, every minute offline means lost sales. Even after the attack ends, customers may be hesitant to return.
• Operational disruption – internal systems that rely on the web server (like email or customer portals) also fail, halting business processes.
• Reputation damage – users may perceive the site as unreliable, and news of the attack can spread quickly on social media.
• Collateral damage – attacks can also affect upstream providers, data centers, and even unrelated services sharing the same infrastructure.
• Extortion – some attackers demand a ransom to stop the attack, though paying does not guarantee it will stop.

For small businesses, a single major DDoS attack can be catastrophic. Unlike a data breach, there is no data to recover—the damage is purely the loss of availability, but that loss can be just as costly.

How Can You Protect Against DDoS Attacks?

There is no way to prevent an attacker from trying to flood your site, but you can reduce the impact. The key is to have a plan before an attack happens.

• Use a DDoS protection service – companies like Cloudflare, Akamai, and AWS Shield offer services that filter traffic before it reaches your server. They detect attack patterns and drop malicious packets while letting legitimate traffic through.
• Increase your bandwidth – having more bandwidth than you need means a small attack won’t saturate your connection. This is not a defense against large attacks, but it buys time.
• Configure firewalls and load balancers – set rate limits on your web server, block suspicious IP ranges, and use SYN cookies to handle half-open connections.
• Have a response plan – know who to call, what steps to take, and how to switch to a backup site if needed. Many attacks are short-lived; a good plan can minimize the damage.
• Keep software patched – while DDoS attacks don’t exploit software bugs, a compromised device on your network could be used as part of a botnet. Regular patching reduces that risk.

It is important to note that no defense is 100% effective. A determined attacker with a large botnet can overwhelm almost any target. The goal is to make the attack expensive for the attacker and to keep your site up long enough for the attack to end or for help to arrive.

Frequently Asked Questions

How long does a DDoS attack last?

Most DDoS attacks are short, lasting from a few minutes to a few hours. However, some attacks can last for days or even weeks, especially if the attacker uses a low-and-slow approach designed to evade detection. The duration depends on the attacker’s goals, the size of the botnet, and the effectiveness of the defense.

Can a DDoS attack be traced back to the attacker?

Tracing a DDoS attack is difficult because the traffic comes from thousands of compromised devices, not the attacker’s own computer. The attacker’s identity is hidden behind the botnet. Law enforcement can sometimes trace the command-and-control server, but it is often hosted in a country with lax laws or on compromised infrastructure, making prosecution rare.

Is a DDoS attack illegal?

Yes, launching a DDoS attack is illegal in most countries under computer fraud and abuse laws. It is considered a criminal offense because it intentionally disrupts services. Even participating in a DDoS attack as a “volunteer� using your own computer can be illegal, as it is still an unauthorized interference with a computer system.

Can a DDoS attack be stopped by simply restarting the server?

Restarting the server can clear the backlog of half-open connections and free up memory, but it does not stop the attack. The traffic will continue to flood in, and the server will go down again as soon as it comes back online. A restart is only a temporary measure and is not a defense.

What is the difference between a DoS and a DDoS attack?

A DoS (Denial-of-Service) attack comes from a single source, such as one computer sending a flood of packets. It is easier to block because you can simply ban that one IP address. A DDoS attack comes from many sources simultaneously, making it much harder to block and often requiring specialized mitigation services.

Related

• SIM Sent a Text Message? Meaning & Fixes
• Check Your PC’s Full? Disk Space Guide
• Install Node.js with NVM on a VPS