Using this site

Please ensure you understand and agree with our data protection policy before using this site. Review Policy

What is a Denial-of-Service (DDoS) Attacks?

Distributed denial of service attack is a cybercriminal network attack in which hackers overwhelm sites or services with fake traffic from multiple "zombie" devices.

» DDoS
What is a Denial-of-Service (DDoS) Attacks? Definition & Types

What is a DDoS?

April 19, 2023

DDoS attacks are a thing you have probably heard about but have never seen. Yet, each time it happens, you see the complaints that a particular site does not respond to and opposite claims from website maintainers about the cyberattack. So is it possible to make the website invulnerable to such attacks? And how are they conducted?

DDoS is an abbreviation for “distributed denial of service”. This definition explains a lot about the essence of this situation. First, however, the reasons, as well as ways of avoidance, must be presented. So, first of all, let’s talk about how it works - it will give you the hints to protect the website from any DDoS attacks.

Distributed denial of service happens when the server receives so many requests that it cannot process them. The server may lack RAM or CPU, but the effect will be the same - web pages will not be opened with the following error numbers:

500something is wrong with the server, without more precise specification;
502invalid response from the server;
503server is temporarily unavailable to handle a request;
504time for server response is exceeded;
509host receives more traffic than the site can handle;
520server returns an unknown error;
521original website server is not available for the intermediary server (usually Cloudflare);
522connection timed out;
523intermediary server (same Cloudflare) is not able to connect to your host server;
524connection through the Cloudflare server is timed out.

How to do a DDoS-attack?

Overloading the server is not easy, especially if we talk about large companies' pages or online services. More than a dozen Google services, Netflix, Amazon, and Microsoft - receive hundreds of thousands of requests per minute - and their servers keep going without any trouble. Proper setting of the response routing and renting or building more servers will make your service available for more customers, besides being more sustainable to any overload.

Cybercriminals who commit DDoS attacks are not inventing anything new. The essence of this sort of cyberattack is creating an enormous amount of requests that overload the server. These attacks are usually conducted with the help of botnets - groups of computers infected with a virus which makes them “zombies”. These machines (some of the uncovered botnets were bigger than 100k computers) are controlled from a single command center. Crooks can tell them to send requests to any site - even to google.com. Having the botnet, which is large enough, you may shut down or make it troublesome to connect even to large and well-known resources.

The scheme of a DDoS attack with the use of botnet

Sometimes, people make unintentional DDoS attacks when the crowd sends many requests to the same server. For example, you may have witnessed such a situation during the 2020 election in the USA, when folks massively opened the fec.gov site (where the official results were posted), causing certain troubles because of server overload.

Types of DDoS attacks

Although all DDoS attacks are based on botnets and committed with the only final target, they differ in creating excessive traffic. The server handles tens of different processes related to a single request simultaneously. Malformed one of them, which will cause an increased load, is one of the most popular methods. However, the power of DDoS is not only in the modified parameters of a request but also in the number of those requests.

DDoS attacks types

So what makes the regular request so hard to handle? Cybercriminals who commit DDoS attacks have a wide range of tools. Experts divide these methods into volume-based attacks, application-layer attacks, and protocol attacks. The first ones clearly state how they are performed; these attacks are the most simple. However, the efficiency per single attacking system for volume-based attacks is pretty low. These attacks usually need much bigger botnets or users to perform.

App layer attacks

Application layer attacks suppose the use of vulnerabilities in the server’s system or application software on this server. In particular, one of the most often used breaches is the HTTP GET or POST requests. Creating the flow of these requests capable of overloading the system takes much fewer resources than other methods. Moreover, you don’t even need to malform the packages - the default HTTP methods are good enough. However, they are quite hard to prepare since the attack must be targeted on a certain server configuration.

Scheme of the DDoS-attack through app layer

Protocol attacks

Protocol attacks seem to be the average between the app layer attacks and volume-based ones. Relatively high efficiency is combined with ease of use and a wide variety of methods. Pings of deaths, fragmented packet attacks, SYN spam - that is only the surface. Each of these ways has a dozen subtypes that make it possible to find the security breach in any system.

How Long Do DDoS Attacks Last?

Two possible timelines may cease the DDoS attack process. The first is reaching the target of the attack (read below), and the second is applying the emergency anti-DDoS measures by the server maintainers, or even both. For example, the latest worldwide-known chain of attacks related to the war in Ukraine lasted for almost a week since the beginning of warfare. A dozen Russian and Ukrainian governmental resources, media agency sites, and banks were unreachable. Attackers reached their target but likely intended to keep the sites down as long as possible. Meanwhile, during this week, the website maintainers managed to deal with the surplus traffic - through connection bans or traffic filtering. Both sides did their job - attackers successfully wrecked the sites, and system administrators mirrored the attack.

Nonetheless, the real success of defendants is only when the attack does not affect the website. Of course, you can do nothing, and low-skilled script kiddies will still fail to shake your website. But the real attack, orchestrated by skilled hackers, requires some real technologies to counteract.

How are websites protected from DDoS attacks?

The First DDoS attack happened during the week of 7th February 2000. This attack was committed by a 15-year-old boy who made a series of attacks against e-commerce services, including Amazon and eBay. Since then, system administrators have discovered many possible ways of DDoS prevention. One of the most popular and best-known ones is captcha solving. When you make many clicks, just like a computer from a botnet that attempts to overload the server with requests, a unique system asks you to solve the captcha.

The classic example of captcha - a filter for the bot-related requests

Another widespread way to decrease the potential server load is to prevent any requests from the bot. Such services as Cloudflare take the request to your website first and offer the “visitor” to solve the same captcha. This method is much more effective than the previously mentioned captcha solving since bots cannot reach the endpoint of the attack.

Of course, an essential element is back-end optimization. The poorly designed back-end may cause problems even when no one attacks your site. However, by optimizing the code, you will increase the upper limit of requests for the period and save a significant amount of money you would spend on server upgrades.

DoS and DDoS attacks - what is the difference?

There is a brother-in-law of DDoS attacks, which is less known, but still met in the real world. Denial of Service attacks mean creating the choking amount of traffic targeted on the certain machine or small network. Flooding the network or the machine will take much less effort than a well-done site with distributed servers and anti-DDoS protection. Such attacks may be applied to suspend the work of a small company or just to mischief a certain user.

DoS attacks don’t require specific software since most of the targets of this type of attack are not protected at all. System administrators may apply some restrictive measures, but it is too expensive to save a tiny network with serious full-fledged anti-DDoS stuff. That’s why those attacks are generally successful. Fortunately, because of the low profitability of these attacks, they are not so popular.

DDoS examples

The best demonstration of how it works and how to counteract it is to review the past or ongoing cases of attack. Fortunately for scientific clarity, there were a lot of attacks in the past several years to review. The first and the latest one is the chain above of DDoS attacks on Russian governmental sites and web pages of commercial banks. The peculiar thing about this attack is that volunteers entirely conducted it. Users intended to offer their computers and mobile phones to threat actors creating the traffic flow using special scripts. This attack took about 9.8 Tbps of bandwidth, which is about an average rate in 2024.

Another example is about the record but is also related to a Russian company. Yandex, the all-in-one internet company nicknamed a Russian Google, reported a world-recording DDoS attack. Due to the company’s notice, they suffered a flow of 22 million requests per second. Even Cloudflare - the company dealing with excessive traffic as its bread and butter - said they had witnessed only a 17.2 million RPS attack. That attack was measured in requests per second because it was committed on volume-based methods. Threat actors tried to disrupt the website accessibility by performing too many requests, and they failed - Yandex did not experience any problems.

Latest DDoS attacks:

Frequently Asked Questions

What is denial of service attacks DDoS and how it occurred?
A DDoS attack occurs when multiple computers attack the same target together. For large-scale attacks, DDoS attackers often use a botnet - a group of hijacked devices connected to the Internet. Attackers exploit security vulnerabilities and device weaknesses to control multiple devices with management and control software. After gaining control, the attacker can command his botnet to launch a DDoS attack on the target. In this case, the infected devices also become victims of the attack.
Is a DDoS attack illegal?
Doing a DDoS attack is a cybercrime in the United States. A DDoS attack can be classified as a federal criminal offense under the Computer Fraud and Abuse Act (CFAA). In addition, the use of download services and stressors is also a violation of this law. Suppose you are guilty of intentionally damaging a computer or server due to a DDoS attack. Then you could get a prison sentence of up to 10 years.
Can you DDoS a Wi-Fi router?
Since routers are hubs that directly handle household Internet traffic, they are exciting to attackers. They are ideally suited to be a vulnerability that gives you access to devices for a DDoS-style attack that overloads the target server with requests and shuts it down. However, the most important reason routers are becoming increasingly vulnerable is that they are much easier to hack than other devices. As web and mobile applications' overall state of security improves, router vulnerabilities are becoming an increasingly important target.
How common are DDoS attacks?
According to a survey of business executives, DDoS attacks are a prevalent type of attack. According to the study, 35% of companies surveyed said they had experienced a DDoS attack in the previous 12 months. No wonder DDoS attacks are expected. Unfortunately, many companies still lack adequate DDoS protection.