Summarise this article with:
What Is a DDoS Attack?
A Distributed Denial of Service attack floods a target with so much traffic from so many sources that legitimate users cannot get through. No password is stolen. No system is broken into. The goal is simple and brutal: overwhelm whatever the target depends on, whether that is bandwidth, server processing capacity, or application resources, until it stops responding.
The key word in the name is "distributed." A basic Denial of Service (DoS) attack comes from a single machine and is relatively easy to block. A DDoS attack routes traffic through hundreds, thousands, or millions of compromised devices at once. Block one IP and a thousand more take its place.
Those compromised devices form what is called a botnet. Routers, security cameras, smart home gadgets, and ordinary computers get infected with malware, and their owners typically have no idea. When an attacker sends the command, every device in the botnet fires traffic at the target simultaneously.
In October 2016, a botnet built from hijacked IoT devices took down Twitter, Netflix, Reddit, Spotify, PayPal, and dozens of other major websites for hours. The attack did not exploit a code vulnerability. It simply buried the infrastructure under an estimated 1.2 Tbps of traffic. That incident, the Mirai botnet attack on DNS provider Dyn, is still one of the clearest illustrations of how DDoS works, and why it remains one of the hardest threats to prevent.
The Three Types of DDoS Attacks
DDoS attacks target different layers of the network. Understanding the three main categories matters because each one requires different defenses.
Volumetric Attacks
Volumetric attacks aim to consume all available bandwidth between the target and the rest of the internet. They generate enormous quantities of traffic, often measured in hundreds of gigabits or terabits per second.
UDP Flood: The attacker sends a flood of User Datagram Protocol packets to random ports on the target server. The server checks each port for a listening application, finds none, and sends back "Destination Unreachable" responses. The back-and-forth alone consumes all available bandwidth and CPU.
DNS Amplification: The attacker sends small DNS queries to open resolvers with the source address spoofed to be the victim's IP. The resolvers send their (much larger) responses to the victim. A 60-byte query can trigger a response roughly 66 times larger, and attackers use thousands of resolvers simultaneously.
NTP Amplification: The same reflection principle applied to the Network Time Protocol. Requests to misconfigured NTP servers can generate responses many times their original size, all pointed at the victim.
Protocol Attacks
Protocol attacks exploit weaknesses in how networking protocols behave, targeting the infrastructure layer rather than raw bandwidth. They exhaust processing capacity on firewalls, load balancers, and servers.
SYN Flood: TCP connections require a three-way handshake: SYN from the client, SYN-ACK from the server, ACK from the client. A SYN flood sends massive numbers of SYN packets from spoofed addresses. The server allocates resources for each half-open connection and waits for an ACK that never arrives. Once the connection backlog fills, no new legitimate connections can form.
Smurf Attack: The attacker sends ICMP echo requests to a network's broadcast address with the source IP spoofed to be the victim's. Every device on the network responds, amplifying the traffic directed at the target.
Ping of Death: Malformed or oversized ping packets that can crash or freeze older systems. Modern operating systems are largely patched against the original variant, but adapted versions still appear.
Application Layer Attacks
Application layer attacks, also called Layer 7 attacks, are the most sophisticated and the hardest to spot. They send requests that look exactly like real user traffic but are designed to exhaust server resources.
HTTP Flood: The attacker fires legitimate-looking GET or POST requests at high volume. Each one requires the server to query a database, generate a page, or perform some computation. Because the requests look real, they slip past many simple filters.
Slowloris: Rather than flooding with volume, Slowloris opens many concurrent connections and keeps them alive by sending partial HTTP headers at a trickle, never completing the request. The server holds each connection open waiting for the rest. Once the connection pool fills, genuine users cannot connect.
Targeted resource exhaustion: Attackers identify whatever is most expensive for the target to process, whether that is a complex search query, a large file download, or a database-intensive API call, and hammer it at scale.
Documented Incidents
Mirai and Dyn (2016)
The botnet mentioned above exploited IoT devices that still had their factory-default usernames and passwords. Around 100,000 infected devices participated in the Dyn attack specifically, though the Mirai malware had compromised a far larger number of devices overall. When Dyn's DNS infrastructure went down, every website that depended on their DNS became unreachable. The attack peaked at approximately 1.2 Tbps.
GitHub (2018)
In February 2018, GitHub was hit with what was then the largest recorded DDoS attack: 1.35 Tbps via memcached amplification. Misconfigured memcached servers received small requests from the attackers but sent enormous responses, with amplification factors reaching up to 51,000 times. GitHub handed traffic off to Akamai Prolexic and was back online within about 20 minutes.
Amazon Web Services (2020)
AWS disclosed that it mitigated a 2.3 Tbps attack in February 2020, driven by CLDAP (Connection-less Lightweight Directory Access Protocol) reflection. CLDAP responses can be 56 to 70 times the size of the triggering request. AWS Shield absorbed the traffic.
Google (2023)
Google mitigated what was then the largest Layer 7 attack ever recorded, peaking at 398 million requests per second. The technique, called HTTP/2 Rapid Reset, exploits the stream multiplexing feature of HTTP/2 to generate enormous server-side workload at minimal attacker cost. Google later noted that this two-minute attack generated more requests than the total Wikipedia article views for the entire month of September 2023.
Cloudflare (2024-2025)
Attack scale has continued rising. Cloudflare reported blocking a 5.6 Tbps UDP flood in Q4 2024, launched by a Mirai variant targeting an ISP in Eastern Asia. In 2025, Cloudflare blocked what it called the largest DDoS attack ever recorded at 11.5 Tbps, a UDP flood that lasted approximately 35 seconds.
How This Affects You
Most internet users experience DDoS attacks as service outages on platforms they use, not as something targeting them personally. When a DNS provider, CDN, or cloud platform is attacked, the websites and apps that depend on it go dark.
Online gaming is a different story. Gaming platforms and game servers are perennially among the most targeted categories for DDoS. Beyond that, individual players can be targeted directly if someone discovers their IP address through a peer-to-peer lobby connection or voice chat. My rule: keep your real IP out of peer-to-peer sessions whenever possible. A VPN handles this automatically.
If you experience sudden, unexplained connectivity problems during a game or after an online dispute with someone, a targeted attack against your home connection is a real possibility. Restarting your router may get you a new IP from your ISP, which ends the attack. You can check what your current public IP exposes at our My IP tool.
Anyone can be exposed. The devices on your home network, your router, your smart TV, your security camera, could silently become part of someone else's attack. If those devices still run default firmware passwords or have not been updated in months, they are prime targets for Mirai-style recruitment.
How to Protect Yourself
For Individual Users
Use a VPN. A VPN masks your home IP so attackers cannot target your connection directly. They can only see the VPN server's address. After connecting, use our VPN Leak Test to confirm your real IP is not leaking. NordVPN is a reliable option with a large server network and built-in threat protection. See also our VPN guide for a full comparison.
Keep devices updated and secured. Change the default password on your router and every IoT device immediately after setup. Enable automatic firmware updates where available. Disable remote management features you do not actually use.
Limit IP exposure in games. Prefer games that route traffic through central servers rather than peer-to-peer connections. Be cautious in voice chat and direct messaging tools that might reveal your IP. Our browser fingerprint tool can show you what metadata is visible from your browser.
Monitor your connection health. Run our Speed Test as a baseline before problems arise, and again if you suspect something is wrong. Unusual packet loss or dramatic speed drops can indicate you are being flooded.
If you suspect your devices may have been compromised and are participating in attacks, check the post Is My IP Blacklisted? for how to find out and what to do about it.
For Website Owners and Businesses
Use a CDN with DDoS mitigation. Services like Cloudflare, AWS Shield, and Akamai absorb and filter attack traffic before it reaches your origin server. Cloudflare's free tier includes basic protection. Their paid plans add capacity and more granular controls.
Implement rate limiting. Configure your server and application to cap the number of requests any single IP can send within a time window. This is your first line of defense against application layer attacks.
Overprovision bandwidth where you can. You cannot out-spend a large-scale volumetric attack, but extra headroom lets you absorb smaller bursts without going offline.
Configure firewalls and access control lists. Block known malicious IP ranges. Filter traffic patterns that match common DDoS signatures. If your service does not need global reach, geo-blocking can reduce your attack surface.
Have an incident response plan before you need it. Know who to contact, what to activate, and how to communicate with users. The first minutes of an attack are when mistakes happen.
What to Do During an Attack
- Stay calm. Most DDoS attacks are short, lasting minutes to a few hours.
- Contact your hosting provider or ISP. They may activate upstream filtering to absorb the attack before it reaches your infrastructure.
- Enable DDoS protection if you have it. If you have a CDN or mitigation service, verify it is active and properly configured.
- Document everything. Log timestamps, traffic volumes, and source patterns. This record helps with post-attack analysis and any law enforcement report.
- Do not pay ransoms. Ransom DDoS (RDoS) attacks come with demands to pay to stop the traffic. Paying does not guarantee the attack stops, and it signals you are a target worth extorting again.
- Report the attack. In most jurisdictions, DDoS attacks are criminal. Report significant attacks to your ISP and to law enforcement.
The Legal Reality
DDoS attacks are illegal in most countries. In the United States, they violate the Computer Fraud and Abuse Act, with penalties of up to 10 years in prison for first-time offenders. In the United Kingdom, they fall under the Computer Misuse Act 1990, where serious offenses can carry sentences up to 14 years.
Despite the legal risk, attacks remain common. "Booter" or "stresser" services sell DDoS-for-hire to anyone with a few dollars and a target. Law enforcement agencies in the US, UK, and EU actively pursue both the operators of these services and their paying customers.
Frequently Asked Questions
Can a VPN protect me from a DDoS attack?
Yes, for personal protection a VPN is one of the most effective tools. By masking your real IP, a VPN prevents an attacker from targeting your home connection. They would need to attack the VPN provider's infrastructure instead, which is built to handle far higher traffic volumes. Use our VPN Leak Test after connecting to make sure your actual IP is not visible. For a full breakdown of options, see our guide to hiding your IP.
How can someone get my IP address to DDoS me?
Peer-to-peer connections in games and file sharing directly expose your IP to other participants. Some messaging platforms and older voice chat tools reveal IP addresses in direct calls. Clicking on specially crafted tracking links can log your address. Even some email clients pass your IP through headers. The My IP tool shows you exactly what your current public address is and what information accompanies it.
How long do DDoS attacks typically last?
The majority of DDoS attacks last less than an hour. Many end within minutes, especially attacks by less sophisticated actors using booter services with limited credit. Sustained campaigns by motivated attackers can run for days or weeks, with periodic bursts to test defenses. Duration depends heavily on the attacker's resources and motivation.
Can my home router be used in a DDoS attack without my knowledge?
Yes. This is exactly how the Mirai botnet operated. Devices with factory-default credentials or unpatched firmware are routinely swept up into botnets. Your router, IP camera, or smart TV could be participating in attacks against others right now without any visible sign on your end. Change default passwords, keep firmware updated, and if you suspect your IP is flagged, read how to fix a blacklisted IP.
What is the difference between a DoS and a DDoS attack?
A DoS attack comes from a single source. Block that one IP address and the attack stops. A DDoS attack comes from thousands or millions of sources simultaneously, typically a botnet distributed across many countries. Because the traffic arrives from many directions and looks similar to real user traffic, blocking it requires much more sophisticated mitigation. The distributed nature is what makes DDoS disproportionately harder to defend against. See our network security basics guide for more on layered defense.
Sources
WhatIsMyLocation Team
Our team of network engineers and web developers builds and maintains 25+ free networking and location tools used by thousands of users every month. Every article is reviewed for technical accuracy using real-world testing with our own tools.
Related Articles
Try Our Location Tools
Find your IP address, GPS coordinates, and more with our free tools.