DDoS (Distributed Denial of Service): Analyzing and Mitigating Traffic Floods

What Is a DDoS Attack? Types, Detection, and How to Stop It

Distributed Denial of Service (DDoS) attacks are one of the most disruptive threats on the internet, and they're accelerating fast. In Q1 2025 alone, Cloudflare blocked 20.5 million DDoS attacks, nearly matching the entire volume blocked across all of 2024. That's a 358% year-over-year surge. Record-breaking attacks are no longer anomalies; they are the new normal.

Whether you're a network engineer, a SOC analyst, or a business owner trying to protect your web presence, understanding how DDoS attacks work and how to stop them is no longer optional.

This guide breaks it all down: what a DDoS attack is, how each attack type works, what the warning signs look like, and what a layered mitigation strategy actually looks like in practice.

What Is a DDoS Attack?

A Distributed Denial of Service (DDoS) attack is a cyberattack in which an attacker floods a target server, website, or network with overwhelming traffic until it can no longer respond to legitimate users. The goal is not to steal data, but to make a service unavailable.

The key distinction from a basic DoS (Denial of Service) attack is the word distributed. Instead of a single machine sending malicious traffic, a DDoS attack leverages thousands or even millions of compromised devices collectively called a botnet, all attacking simultaneously. That distributed nature is what makes it so difficult to defend against: you can't just block one IP address and move on.

A useful analogy: imagine a flash mob of thousands of people crowding the entrance of a store, making it impossible for real customers to get inside. The store isn't broken, it's just inaccessible.

➤ Check this full Guide and see how threat intelligence sources reveal emerging DDoS infrastructure.

Who Gets Targeted?

DDoS attacks are used against a broad range of targets, including:

• Banks and financial institutions.
• E-commerce platforms.
• Gaming services.
• Government and critical infrastructure.
• News and media outlets.

Motivations range from financial extortion and competitive sabotage to hacktivism and geopolitical conflict. During Russia's invasion of Ukraine in 2022, for example, DDoS attacks were used as a tool of hybrid warfare against government, financial, and media targets across Europe.

How Does a DDoS Attack Work?

Most DDoS attacks are powered by botnets, large networks of compromised devices controlled through Command-and-Control (C2) infrastructure. These infected devices can include anything from home routers and IoT sensors to cloud servers and, increasingly, Android smart TVs.

The Aisuru-Kimwolf botnet, which emerged in mid-2025, comprised an estimated 1 - 4 million infected devices and routinely launched attacks exceeding 1 terabit per second. In September 2025, Cloudflare recorded and autonomously blocked a 22.2 Tbps DDoS attack the largest ever recorded at the time.

Modern DDoS operations typically include:

A botnet infrastructure, thousands of compromised devices acting in coordination.

Traffic amplification, exploiting misconfigured protocols (DNS, NTP, CLDAP) to multiply attack volume by 10x–70x.

IP spoofing, forging source addresses to hide the true origin, and preventing simple blocks.

Multi-vector attacks, combining network, protocol, and application-layer floods simultaneously.

Dynamic switching, rapidly changing attack methods to evade signature-based defenses.

➤ Learn how Digital Forensics supports post-DDoS investigations.

Types of DDoS Attacks

DDoS attacks target different layers of the OSI model. Understanding the three primary categories helps you recognize what you're facing and respond appropriately.

1. Volumetric Attacks

These attacks aim to saturate your network's bandwidth capacity. They're measured in gigabits per second (Gbps) or terabits per second (Tbps) and are the most immediately visible attack type.

Common examples:

UDP floods: Send massive volumes of UDP packets to random ports, forcing the target to respond to each one.

ICMP floods: Overwhelms the target with ping requests.

DNS amplification: Sends small queries with a spoofed source IP; DNS servers send large responses to the victim, amplifying the traffic volume significantly.

NTP amplification: A similar technique exploiting the Network Time Protocol.

Warning signs:

• Sudden, sustained inbound traffic spikes.
• Extremely high packets-per-second (PPS) rates.
• Thousands of unique source IPs are hitting your network simultaneously.
• Bandwidth saturation alerts from your ISP or CDN.

In Q1 2025, DNS-based attacks remained among the most prevalent vectors, while ESP reflection/amplification attacks surged 2,301% quarter-over-quarter a reminder that attackers constantly rotate to newer, less-defended protocols.

2. Protocol Attacks 

Rather than overwhelming bandwidth, protocol attacks exploit weaknesses in network protocols to exhaust connection state tables and networking device resources, such as firewalls, routers, and load balancers.

Common examples:

SYN floods: The most common protocol attack. The attacker sends a barrage of TCP SYN (connection initiation) packets but never completes the handshake. The server holds each connection open, waiting for acknowledgment, exhausting its connection table until it can accept no new legitimate connections.

Fragmentation attacks: Send malformed or excessive IP fragments that overload reassembly buffers.

RST floods: Flood a target with TCP RST (reset) packets to tear down legitimate connections.

Warning signs:

• Abnormal SYN-to-ACK ratios in firewall logs.
• Large volumes of incomplete TCP handshakes.
• Excessive connection timeouts.
• Firewall or load balancer CPU and memory strain.

➤ Design scalable alerts using Detection Engineering best practices.

SYN floods accounted for 23% of all network-layer DDoS attacks observed by Cloudflare in 2024, making them the second most common vector after DNS-based attacks.

3. Application Layer Attacks

These are the most sophisticated and hardest to detect. Instead of overwhelming bandwidth, Layer 7 attacks exhaust application resources by mimicking legitimate user behavior. A single attacking machine can generate enough traffic to crash a web server if it targets expensive operations.

Common examples:

HTTP GET/POST floods: Bombard a web server with enormous volumes of seemingly legitimate HTTP requests.

Slowloris: Opens many partial HTTP connections and keeps them alive indefinitely, tying up web server threads without triggering bandwidth alarms.

DNS query floods: Overwhelm DNS resolvers with recursive queries, disrupting name resolution for entire services.

Warning signs:

• Elevated HTTP requests per second (RPS) on specific endpoints.
• Repeated access patterns targeting a single URL or API route.
• Randomized or rotating user-agent strings and headers.
• CPU and memory spikes on application servers without corresponding bandwidth alerts.
• Spike in HTTP 5xx error responses.

➤ Understand why Behavioral Detection outperforms static rules.

Because application-layer attacks look similar to real user traffic, static rule-based defenses are often insufficient. Behavioral analysis and traffic baselining are essential.

How to Detect a DDoS Attack

Detection requires correlated visibility across multiple data sources. Relying on a single metric bandwidth alone, for instance, creates dangerous blind spots.

Step 1: Establish Traffic Baselines

You cannot detect anomalies without knowing what "normal" looks like. Document your:

• Average bandwidth consumption by time of day and day of week.
• Normal request rates per endpoint.
• Typical geographic distribution of traffic sources.
• Standard protocol ratios (TCP vs. UDP, HTTP vs. HTTPS)

Step 2: Monitor Key Indicators

Network-level signals:

• Sustained inbound traffic spikes, especially from unusual geographies.
• Abnormally high packets-per-second rates.
• Unexpected UDP or ICMP volume.

Application-level signals:

• Repeated requests to the same endpoint.
• Sudden latency increases or elevated error rates.
• Backend database queries are spiking without corresponding user activity.

Infrastructure signals:

• Firewall CPU or memory reaching capacity.
• Load balancer connection table exhaustion.
• ISP alerting on upstream bandwidth anomalies.

Step 3: Use SIEM for Correlation

A SIEM platform aggregates log data from firewalls, WAFs, CDNs, and application servers into a single view. Automated alerting rules can flag:

• Excessive failed connection attempts.
• Repeated access from known malicious IP ranges.
• Sudden service degradation correlated with traffic spikes.

Machine learning models layered on top of SIEM can identify subtle statistical anomalies like unusual timing patterns in HTTP requests that static rules miss.

➤ Compare SIEM and SOAR capabilities in modern SOC workflows.

DDoS Mitigation Strategies

No single control stops a DDoS attack. Effective defense is always layered.

1. Rate Limiting and Traffic Filtering

At the network edge, configure:

• Access Control Lists (ACLs) to block traffic from known malicious IP ranges.
• Connection rate limits to cap the number of new connections per IP per second.
• SYN cookies to defend against SYN flood attacks without holding state for incomplete handshakes.

At the application layer:

• WAF rules to filter malicious HTTP patterns, block known bad user agents, and enforce per-IP request limits.
• CAPTCHA / challenge-response for suspicious sessions to separate bots from humans.

2. Infrastructure-Level Protections

• Anycast routing distributes incoming attack traffic across multiple data centers globally, diluting the impact of even high-volume floods.
• Intelligent load balancers can identify and separate anomalous traffic from legitimate flows.
• Scrubbing centers inspect all incoming traffic and forward only clean traffic to your origin servers, a key component of dedicated DDoS mitigation services.

3. Cloud-Based DDoS Protection

For most organizations, cloud-scale protection is the most practical defense against large volumetric attacks. Leading options include:

• Cloudflare: Edge-based, always-on DDoS mitigation with a 296 Tbps network capacity.
• AWS Shield: Automatic protection for AWS-hosted workloads, with the Advanced tier for larger attacks.
• Azure DDoS Protection: Integrated with Azure's network with adaptive tuning.
• Google Cloud Armor: ML-based adaptive protection at Google's network edge.

CDNs like Cloudflare and Akamai absorb and scrub attack traffic at the edge before it ever reaches your origin infrastructure.

Important: Elastic cloud scaling can help absorb temporary traffic spikes, but it should complement active mitigation not replace it. Auto-scaling into a DDoS attack without filtering simply raises your cloud bill while the attacker keeps flooding.

4. Upstream ISP Coordination

When internal and cloud defenses are insufficient, coordinate with your ISP for:

• Upstream traffic filtering: Block attack traffic before it reaches your network.
• Blackhole routing (RTBH): Null-route all traffic to an attacked IP, stopping the flood at the cost of taking the service fully offline temporarily.
• Traffic rerouting: Divert traffic through scrubbing infrastructure.

This level of response is reserved for severe, sustained attacks, often those with an extortion or geopolitical motive.

DDoS Response: A Structured Workflow

When an alert fires, follow a repeatable process:

1. Validate the alert: Confirm it's an attack, not a legitimate traffic surge (product launch, viral content)

2. Profile the traffic: Identify the attack vector, measure bandwidth/PPS/RPS, and map geographic sources.

3. Assess infrastructure impact: Check firewall health, server load, and collateral damage to adjacent systems.

4. Notify stakeholders: Alert network, infrastructure, and application teams; escalate to your ISP or cloud provider as needed.

5. Deploy mitigation: Apply rate limits, activate WAF rules, enable cloud protection, and geo-block if appropriate.

6. Monitor continuously: Watch for vector shifts; attackers frequently rotate methods when one is blocked.

7. Preserve evidence: Collect packet captures, logs, and system snapshots for post-incident analysis.

After the Attack: Forensics and Improvement

Post-incident analysis is where long-term resilience is built.

Log analysis reveals attack patterns, entry points, and the effectiveness of each mitigation step.

Packet captures allow full reconstruction of the attack timeline.

Botnet signature identification may enable proactive blocking of future campaigns from the same infrastructure.

Impact assessment quantifies downtime duration, revenue loss, and affected user count.

Document everything: timeline, metrics, mitigation steps taken, and lessons learned. This documentation feeds directly into refining your detection thresholds and playbook procedures.

Building Your DDoS Playbook

A documented, pre-approved playbook eliminates dangerous hesitation during high-pressure incidents. At a minimum, your playbook should define:

• Detection thresholds that trigger response procedures.
• Escalation paths (internal team → cloud provider → ISP → law enforcement)
• Pre-approved mitigation actions that don't require real-time management approval.
• Communication templates for stakeholders and customers.
• Evidence collection procedures.
• Post-incident review steps.

Run tabletop exercises at least twice a year. Simulate attack scenarios against your actual infrastructure. Gaps discovered in a tabletop exercise are infinitely less costly than gaps discovered during a live attack.

Frequently Asked Questions

How do I tell a DDoS attack apart from a legitimate traffic spike? 

A: Correlate traffic anomalies with business context. A legitimate spike (product launch, news mention) will show diverse user behavior across many endpoints and geographic regions. A DDoS attack typically shows high-volume traffic concentrated on specific endpoints, with repetitive request patterns, unusual protocol distributions, or geographic sources inconsistent with your user base.

Can DDoS attacks be fully prevented? 

A: Complete prevention is unrealistic given the scale of modern botnets. However, layered mitigation edge filtering, WAF rules, cloud protection, and ISP coordination drastically reduce both the likelihood of service disruption and its duration when an attack does occur.

Why are DDoS attacks getting worse? 

A: The commoditization of attack-for-hire services (booter/stresser services), the explosive growth of IoT devices with weak security, and AI-assisted attack automation have dramatically lowered the cost and skill barrier for launching large-scale attacks. The result: more attackers, bigger botnets, and higher attack volumes.

What tools does a SOC analyst need for DDoS defense? 

A: Core tools include flow monitoring (NetFlow/sFlow), a SIEM for log correlation, a Web Application Firewall, cloud-based DDoS protection, and packet capture capabilities for forensic analysis.

Key Takeaways

• DDoS attacks are surging, Q1 2025 saw 358% more attacks year-over-year, with record-breaking volumes becoming routine.
• Three attack categories target different layers: volumetric (bandwidth), protocol (connection state), and application (resource exhaustion)
• Detection requires baselines; you can't spot anomalies without knowing what normal looks like.
• No single defense is sufficiently effective; mitigation is always multi-layered.
• Cloud-scale protection is essential; on-premise defenses alone cannot absorb modern hyper-volumetric attacks.
• Playbooks and practice reduce response time and decision-making errors when an attack hits.

DDoS resilience isn't a product you buy once; it's an operational capability you build, test, and continuously improve.