What Is a DDoS Attack?
How DDoS Attacks Overwhelm a Website
What is a DDoS attack? It is an attempt to make a website, server or network unavailable by flooding it with more traffic or requests than it can handle. DDoS stands for distributed denial of service. The traffic comes from many sources at once, which makes it much harder to block than a single source.
A denial-of-service attack from one machine is easy to block by address, so attackers often use botnets. A botnet is a network of computers infected with malware and controlled remotely, and the owners of those devices usually do not know they are involved. Automated traffic of this kind is discussed further in malicious bots.
The Main Types of DDoS Attack
Attacks are commonly grouped by the part of the connection they target:
- Volumetric attacks fill the network connection with so much traffic that legitimate requests cannot get through.
- Protocol attacks exhaust resources that network devices or servers use to track connections, such as SYN floods, which fill a server's table of half-open connections.
- Application-layer attacks send requests that look like normal visitors but trigger expensive work, such as repeated searches or logins.
Application-layer attacks are harder to tell apart from popular traffic, which is one reason they can be difficult for smaller sites to handle.
What a DDoS Attack Does to a Site
The most visible effect is slowness or downtime. Visitors see timeouts, errors or pages that never finish loading. Some attacks take a site offline for their full duration, while others arrive in waves that come and go.
Hosting environments can suffer collateral damage. On a shared server, one site under attack can slow the others, and providers may limit or filter traffic to protect the wider network. Defenses for this are described in DDoS protection.
Frequently asked questions
Do DDoS attacks steal data?
Usually not. A DDoS attack is designed to overload a service rather than read or change its data. However, it can be used to distract staff, hide other activity or make a service unavailable while another attack is attempted. DDoS is one of the common website security threats, so monitoring the site during an incident is worthwhile.
How can I tell a DDoS attack from a traffic surge?
Look at where the traffic comes from and what it requests. A sudden rise from many unusual addresses, repeated requests for the same expensive page, or visits that do not follow normal browsing patterns may point to an attack. A genuine surge, such as one after a successful promotion, usually shows varied pages and typical visitor behavior.