What Is a DDoS Attack? Types, Famous Attacks & Prevention

A DDoS attack (Distributed Denial of Service attack) is a cyberattack where thousands of compromised devices simultaneously flood a target server, network, or application with fake traffic, causing it to slow down or crash completely. Unlike a single-source DoS attack, DDoS uses a botnet of hijacked devices, making it far harder to block.

• DDoS attacks use botnets, networks of hijacked devices, to overwhelm targets with traffic from hundreds of countries simultaneously.
• Three main DDoS attack types exist: volumetric, protocol, and application-layer, and each requires a different defense strategy.
• The largest recorded DDoS attack hit 3.47 Tbps, targeting a Microsoft Azure customer in November 2021, according to Microsoft’s own threat report.
• DDoS is illegal in India under the Information Technology Act, 2000, and can carry imprisonment up to three years.
• Mitigation is possible through a layered approach combining CDNs, rate limiting, anycast diffusion, and real-time traffic analysis.

How Does a DDoS Attack Actually Work?

Before attackers launch anything, they build or rent a botnet. A botnet is a collection of internet-connected devices, laptops, home routers, IoT sensors, even CCTV cameras, that have been quietly infected with malware. The device owner usually has no idea their machine is part of one.

When the attacker gives the signal, every bot in the network starts sending requests to the same target at the same time. A server that normally handles 10,000 requests per minute might suddenly receive 10 million. Its resources max out. Real users get error messages or timeouts. The site is effectively offline.

According to Cloudflare’s 2024 DDoS Threat Report, the company blocked over 8.5 million DDoS attacks in 2023 alone, a 65% increase year-on-year. That growth is not slowing down.

Understanding attack traffic is where cybersecurity logs become critical. Log analysis lets security teams distinguish a genuine traffic spike from a DDoS attack pattern, and it is one of the first skills a SOC analyst needs on the job.

DDoS vs DoS: What Is the Difference?

A DoS (Denial of Service) attack comes from a single machine. One attacker, one IP address, one stream of traffic. It is relatively easy to block because you can just firewall that one source.

A DDoS attack comes from thousands or millions of sources simultaneously. Blocking individual IPs does not work because the next wave comes from entirely different addresses. That distributed nature is exactly what makes DDoS mitigation a specialised discipline rather than a simple firewall rule.

Feature	DoS Attack	DDoS Attack
Traffic source	Single machine	Thousands of machines (botnet)
Difficulty to block	Low (block one IP)	High (sources constantly change)
Scale of attack	Limited by one device	Can reach terabits per second
Detection complexity	Simple	Requires advanced traffic analysis
Common mitigation	IP blocking, rate limiting	CDN, anycast, scrubbing centres

Types of DDoS Attacks You Need to Know

Not all DDoS attacks look the same. Security teams categorise them by the layer of the network they target, and that categorisation directly determines which defenses work.

Volumetric DDoS Attacks

These are the brute-force floods. The goal is to saturate the target’s bandwidth entirely. UDP floods and DNS amplification attacks fall here. Attackers send small requests to open DNS resolvers that respond with much larger packets, all aimed at the victim. The amplification ratio can be 50x or higher.

The record-breaking 3.47 Tbps DDoS attack on Microsoft Azure in 2021 was volumetric. It used UDP reflection across multiple countries and lasted approximately 15 minutes before mitigation kicked in.

Protocol DDoS Attacks

These target weaknesses in network protocols rather than raw bandwidth. The classic example is a SYN flood. In a normal TCP handshake, a client sends a SYN packet, the server responds with SYN-ACK, and the client confirms. In a SYN flood, the attacker sends millions of SYN packets but never completes the handshake. The server keeps those half-open connections in memory until it runs out of capacity entirely.

Application-Layer DDoS Attacks

These are the most sophisticated and hardest to detect. Instead of flooding bandwidth, attackers send what looks like legitimate HTTP requests, targeting specific pages or API endpoints that are expensive to process. A Layer 7 HTTP flood against a database-heavy search page can bring down a server with surprisingly little traffic.

India’s digital public infrastructure has seen this type of DDoS attack. During the 2020 India-China border tensions, Indian government websites including National Informatics Centre-hosted portals reportedly faced application-layer probing attempts, according to security researchers coordinating with CERT-In. More recently, CERT-In’s 2023 Annual Report noted a significant rise in DDoS incidents targeting Indian banking and government sectors, reinforcing the need for layered defenses across critical systems.

If you want to understand how these DDoS attacks affect critical systems at scale, read our deeper piece on protecting critical infrastructure from cyber attacks.

Famous DDoS Attacks in History

Knowing the record attacks puts the scale of the problem in context. Here is a quick timeline of landmark DDoS incidents.

Year	Target	Peak Size	Method
2016	Dyn DNS	1.2 Tbps	Mirai botnet (IoT devices)
2018	GitHub	1.35 Tbps	Memcached amplification
2020	Amazon AWS	2.3 Tbps	CLDAP reflection
2021	Microsoft Azure	3.47 Tbps	UDP reflection, multiple vectors
2023	Cloudflare customers	71 million rps	HTTP/2 Rapid Reset exploit

The 2023 HTTP/2 Rapid Reset DDoS attack, disclosed jointly by Google, Cloudflare and AWS, set a new record at 71 million requests per second. It exploited a flaw in the HTTP/2 protocol itself, meaning even well-resourced targets were vulnerable until patches were applied.

If you are building a career defending against DDoS attacks and threats like these, our SOC Analyst Certification Course at 3.0 University covers DDoS detection, incident response, and log analysis in a structured, job-ready curriculum.

How to Prevent a DDoS Attack: Protection Strategies That Work

The honest answer is that no single tool stops a determined DDoS attack. What works is a layered defense, multiple controls that together make an attack expensive and ineffective enough that the attacker gives up or moves on.

Rate Limiting and Traffic Filtering

Rate limiting caps the number of requests a single IP or IP range can make in a given time window. It is a basic but effective first line of defense against low-volume application-layer DDoS attacks. Most modern web servers and API gateways support it natively.

Traffic filtering uses rules to drop packets that match known attack signatures, malformed headers, spoofed source addresses, or unusual protocol combinations. This happens at the network edge before traffic ever reaches your application server.

CDN and Anycast Diffusion

A Content Delivery Network (CDN) distributes your content across dozens or hundreds of edge nodes globally. When a DDoS attack hits, the traffic is spread across all those nodes instead of concentrating on one origin server. Cloudflare, Akamai, and AWS CloudFront all provide DDoS absorption at the CDN layer.

Anycast routing takes this further. The same IP address is announced from multiple data centres worldwide. DDoS attack traffic gets automatically routed to the nearest node, where it is absorbed or filtered before reaching your infrastructure.

Scrubbing Centres and Upstream Mitigation

For large-scale volumetric DDoS attacks, traffic gets re-routed through scrubbing centres, specialised facilities that strip out malicious packets and return only clean traffic to the destination. Providers like Radware, NETSCOUT Arbor, and Tata Communications offer this as a managed service in India.

According to the Ponemon Institute’s 2023 Cost of a Cyber Attack Study, the average cost of DDoS-related downtime is approximately $22,000 per minute for enterprise organisations. That figure makes the investment in mitigation services straightforward to justify.

Is a DDoS Attack Illegal in India?

Yes, without question. Launching a DDoS attack in India is a criminal offence under Section 43 and Section 66 of the Information Technology Act, 2000. Section 66 specifically covers computer-related offences including unauthorised denial of access, and carries a penalty of up to three years imprisonment and a fine up to five lakh rupees.

CERT-In, India’s national cybersecurity response team, actively monitors and coordinates response to DDoS incidents targeting Indian infrastructure. Ethical hacking courses and certifications exist precisely to teach these DDoS attack techniques in a legal, controlled environment, and 3.0 University’s programmes follow that same principle.

Frequently Asked Questions

What is a DDoS attack in simple terms?

A DDoS attack is when many computers, usually infected with malware and controlled by an attacker, all flood one target with traffic at the same time. The target gets overwhelmed and stops working for real users. It is the digital equivalent of thousands of prank callers blocking a phone line so no genuine calls can get through.

How do DDoS attacks work?

Attackers first build or rent a botnet, a network of compromised devices. They then direct every device to send requests or packets to a single target simultaneously. The target’s server, bandwidth, or application layer gets exhausted trying to handle the load. Depending on the DDoS attack type, the method exploits bandwidth limits, protocol weaknesses, or application processing costs.

How do you prevent a DDoS attack?

DDoS attacks can be mitigated, though rarely stopped at the source entirely. A layered defense combining CDNs, rate limiting, anycast routing, traffic filtering, and scrubbing centres significantly reduces the impact. Large providers like Cloudflare and AWS can absorb even terabit-scale DDoS attacks. No single tool is sufficient, but a well-designed architecture makes most attacks ineffective.

Can DDoS attacks be stopped completely?

No defense guarantees 100% protection against every DDoS attack, but layered mitigation makes most attacks ineffective. The goal is to raise the cost and complexity for the attacker until they abandon the attempt. Organisations with CDN coverage, scrubbing centre contracts, and real-time monitoring in place recover far faster and often avoid visible downtime entirely.

Is a DDoS attack illegal in India?

Yes. DDoS attacks violate Sections 43 and 66 of India’s Information Technology Act, 2000. Offenders can face up to three years in prison and fines up to five lakh rupees. CERT-In coordinates national-level responses to major DDoS incidents. Even attempting or facilitating a DDoS attack, such as by renting botnet services, carries legal risk under the same law.

What was the largest DDoS attack ever?

By requests per second, the largest DDoS attack was the HTTP/2 Rapid Reset attack in 2023, peaking at 71 million requests per second, disclosed by Google, Cloudflare, and AWS. By bandwidth, the 2021 DDoS attack on a Microsoft Azure customer in Asia reached 3.47 terabits per second, lasting around 15 minutes before Azure’s mitigation infrastructure absorbed it, according to Microsoft’s published threat intelligence.

What is the difference between a DDoS attack and hacking?

A DDoS attack aims to make a service unavailable by overwhelming it with traffic. It does not typically involve gaining unauthorised access to data or systems. Hacking, by contrast, usually involves exploiting vulnerabilities to access, steal, or manipulate data. DDoS attacks are often used as a distraction while a separate intrusion attempt takes place in the background.

DDoS attacks are not slowing down, and neither is the demand for professionals who know how to stop them. SOC analysts, network security engineers, and cloud security specialists all deal with DDoS attack response as a core part of the job. If you are serious about building those skills, the SOC Analyst Certification Course at 3.0 University gives you hands-on training in threat detection, log analysis, and incident response, exactly the skills employers are hiring for right now.

Start by understanding the DDoS attack types, build your detection skills with real log data, and layer your defenses so no single point of failure can bring your infrastructure down.

Last updated: July 2026. Reviewed by the 3University editorial team.