Understanding DDoS Attacks
From Packets to Petabits
A distributed denial-of-service attack overwhelms a target with traffic from thousands of sources simultaneously. This guide covers the mechanics, measured amplification ratios, and mitigation strategies used by network operators worldwide.
What Is a DDoS Attack
A distributed denial-of-service (DDoS) attack is a coordinated attempt to exhaust a target's available resources — bandwidth, connection-state tables, CPU cycles, or memory — by sending traffic simultaneously from a large number of geographically distributed sources. The goal is to make a server, service, or network unavailable to legitimate users.
The word "distributed" is the defining feature: unlike a simple flood from one host, a DDoS attack uses hundreds to hundreds of thousands of cooperating machines. This makes simple IP-based blocking ineffective, since no single source address carries enough traffic to be a useful filter threshold.
At the network layer, a DDoS attack consumes link capacity. At the transport layer, it exhausts connection state. At the application layer, it consumes server processing power answering expensive requests. Each layer requires a different mitigation approach, which is why one-size-fits-all defenses frequently fail.
Key term: Packets per second (pps) and bits per second (bps) measure two distinct dimensions of an attack. A high-bps attack saturates uplinks. A high-pps attack exhausts CPU and TCAM state. Defending against one does not automatically defend against the other.
DoS vs. DDoS: Key Differences
A denial-of-service (DoS) attack originates from a single host. Its peak rate is bounded by one machine's uplink — typically 1–10 Gbps for a datacenter VM — and it can be nullrouted with one firewall rule. A DDoS attack is qualitatively different because:
Source diversity
Traffic arrives from hundreds of ASNs and IP prefixes simultaneously. Blocking any one prefix drops negligible traffic volume while adding ACL overhead.
Spoofed sources
UDP-based volumetric attacks use spoofed source IPs that cannot be traced back to the botnet's real infrastructure. BCP38 ingress filtering is the only systemic fix.
Aggregate bandwidth
A botnet of 100,000 IoT devices each contributing 10 Mbps generates 1 Tbps — more bandwidth than most tier-1 ISP peering points.
Amplification leverage
Reflection attacks multiply the attacker's bandwidth by up to 51,000× using protocol amplifiers, enabling Tbps-scale floods from a few Gbps of source traffic.
| Dimension | DoS | DDoS |
|---|---|---|
| Source count | 1 host | Hundreds to millions |
| Mitigation | Single IP block | Scrubbing, anycast, BGP blackhole |
| IP spoofing | Rare | Common in UDP floods |
| Max observed bandwidth | ~100 Gbps | 31.4 Tbps (2025 record) |
| Infrastructure cost | One machine | Botnet rental or amplifiers |
The Three Layers of DDoS
DDoS attacks target one of three layers of the networking stack. Understanding the layer determines which mitigation tools apply.
Layer 3/4 — Volumetric Attacks
Volumetric attacks fill the target's available bandwidth with packets. The unit of measurement is bits per second (Gbps/Tbps). Common vectors: UDP flood, ICMP flood, DNS amplification, NTP amplification, Memcached reflection.
Packet math: A 10 GbE link at line rate carries roughly 14.88 million 64-byte packets per second. A volumetric attack must either saturate bps (with large packets) or pps (with minimum-size packets). Modern attacks often use mixed sizes to defeat both bps and pps thresholds simultaneously.
Layer 3/4 — Protocol Attacks
Protocol attacks exploit the state maintained by network equipment. The unit of measurement is packets per second (Mpps). Common vectors: SYN flood (exhausts TCP half-open connection tables), ACK flood (exhausts stateful firewall tables), fragmented packet flood (exhausts reassembly buffers).
SYN backlog math: A typical Linux kernel defaults to a SYN backlog of 512 entries. At 1,000 SYNs/sec with no SYN-cookies enabled, the table fills in 512 ms. Legitimate connections are then refused for the duration of the flood.
Layer 7 — Application-Layer Attacks
Application-layer (L7) attacks send valid, well-formed requests that consume server-side compute. The unit of measurement is requests per second (rps). Common vectors: HTTP GET/POST flood, Slowloris (keeps connections open with partial headers), HTTPS flood (TLS handshake CPU cost), DNS query flood.
L7 asymmetry: A single HTTPS request triggers a TLS handshake (~2–5 ms of CPU per connection), a DNS lookup, and potentially a database query. An attacker at 50,000 rps forces the server to perform ~250,000 upstream operations per second while the attacker's cost is just sending packets.
Amplification Attacks: Calculated Bandwidth Math
Amplification (also called reflection-amplification) is the most efficient DDoS technique. The attacker sends a small UDP request to a public server with the victim's IP spoofed as the source. The server sends a large response to the victim. Two multipliers compound:
- Bandwidth Amplification Factor (BAF) — response bytes ÷ request bytes
- Source multiplier — number of amplifier IPs reachable simultaneously
| Protocol | Request size | Max response | BAF | Open servers (est.) |
|---|---|---|---|---|
| Memcached UDP | 15 bytes | ~750 KB | 51,000× | ~50,000 |
| NTP Mode 6 | ~10 bytes | ~468 bytes | 556× | ~2.7M |
| CharGEN | 1 byte | ~358 bytes | 358× | ~22,000 |
| DNS ANY | ~40 bytes | ~2,000 bytes | 54× | ~28M open resolvers |
| SSDP | ~110 bytes | ~3,300 bytes | 30× | >3M |
| LDAP UDP | ~52 bytes | ~3,640 bytes | 70× | ~250,000 |
| CLDAP | ~52 bytes | ~3,640 bytes | 70× | >200,000 |
Calculated: How Much Source Traffic Is Needed?
The following calculations show precisely how little upstream bandwidth an attacker needs to generate a given attack volume using each amplifier class.
// Example 1: Generating 1 Tbps via NTP (BAF = 556×)
1,000 Gbps ÷ 556 = 1.80 Gbps source traffic needed
// Example 2: Generating 100 Gbps via Memcached (BAF = 51,000×)
100 Gbps ÷ 51,000 = ~1.96 Mbps source traffic needed
// Example 3: Generating 10 Gbps via DNS (BAF = 54×)
10 Gbps ÷ 54 = 185 Mbps source traffic needed
Interpretation: A Memcached amplification attack achieving 100 Gbps requires less source bandwidth than a standard home broadband connection (2 Mbps). This asymmetry is why amplification attacks remain the most cost-effective DDoS vector available.
Maximum Theoretical Aggregate (NTP)
2,700,000 × 1 Mbps × 556 = ~1,501 Tbps theoretical maximum
// In practice: limited by attacker's query throughput and server stability
// Real-world observed peak: ~940 Gbps from NTP amplification (2018)
Memcached record: In 2018, a Memcached amplification attack peaked at 1.7 Tbps — the highest ever recorded at the time. Each reflector sent ~500× the size of the query back to the victim, and fewer than 100,000 Memcached servers were responsible for the full volume.
Botnet Capacity Analysis
In direct-flood DDoS attacks (no amplification), the attacker's bandwidth is limited by the aggregate uplink of botnet nodes. Understanding botnet capacity helps size the defenses needed.
Aggregate Bandwidth by Botnet Size
10,000 nodes × 10 Mbps = 100 Gbps
100,000 nodes × 10 Mbps = 1 Tbps
600,000 nodes × 1.5 Mbps = 900 Gbps // Mirai-class estimate
IoT Botnets
Compromised cameras, routers, and smart devices. High node count, low individual bandwidth (~1–25 Mbps). Mirai (2016) demonstrated 620 Gbps from ~145,000 nodes.
Cloud VPS Botnets
Fewer nodes (hundreds to thousands) but each node may have 1–25 Gbps NICs. A 1,000-node cloud botnet at 1 Gbps each = 1 Tbps aggregate.
Desktop/Server Botnets
Compromised corporate servers and PCs. Higher per-node bandwidth than IoT but more easily detected by behavioral anomaly systems.
Calculated: SYN Flood Packet Rate
10 GbE line rate: 10,000,000,000 bps ÷ 480 = 20.83 Mpps
1 GbE line rate: 1,000,000,000 bps ÷ 480 = 2.08 Mpps
// A 10Gbps SYN flood at 20.83 Mpps fills a 512-entry backlog in:
512 ÷ 20,830,000 = ~24.6 microseconds per server
SYN cookies mitigate this: Linux SYN-cookies encode connection state cryptographically in the SYN-ACK sequence number, eliminating the half-open table entirely. However, SYN cookies impose ~10% CPU overhead at high connection rates and break some TCP options negotiation.
Detection Latency Models
Detecting a DDoS attack in progress involves distinguishing malicious traffic from legitimate spikes. The two main sampling approaches have different detection latency profiles.
Flow Sampling (sFlow/NetFlow)
Routers sample 1 in every N packets and export flow records. At sampling ratio 1:1,000:
Confidence (95%): ~30 samples needed
Detection latency: ~300 ms
At 1:10,000 sampling: 10 samples/sec → 3 seconds to 95% confidence. Flow sampling trades CPU cost for detection speed.
Full-Rate DPI Inspection
Deep packet inspection at line rate analyzes every packet in hardware. Detection latency approaches zero, but requires ASIC-based infrastructure:
~148.8 Mpps @ 64-byte min frame
Detection: sub-100 ms
Full-rate DPI is cost-effective only for scrubbing centers processing >100 Gbps aggregate.
BGP Blackhole (RTBH) Response Time
BGP UPDATE announcement → iBGP propagation → ~2–5 seconds
// Remote-triggered blackhole drops ALL traffic to victim IP
// Effective but indiscriminate — legitimate traffic is also dropped
Flowspec (RFC 5575) extends BGP blackholing to filter by source prefix, protocol, port, or DSCP, enabling surgical mitigation that preserves legitimate traffic while discarding attack flows.
Mitigation Architecture
Modern DDoS mitigation uses layered defenses at the network, transport, and application layers. No single technique is sufficient for all attack types.
Anycast Diffusion
Announce the target IP prefix from dozens of PoPs worldwide. Attack traffic is spread across all PoPs proportionally. Each PoP absorbs a fraction of total volume. Effective for volumetric attacks exceeding any single scrubbing center's capacity.
BGP Blackhole (RTBH)
Inject a /32 host route with community tag no-export to trigger null routing at upstream peers. Stops the attack reaching your network but sacrifices availability for the victim IP entirely.
Scrubbing Centers
Re-route traffic via GRE or MPLS tunnel to a scrubbing facility. Hardware DPI examines each packet, drops attack flows, and forwards clean traffic to origin. Effective for multi-vector attacks; adds 5–30 ms latency.
Rate Limiting (BPS/PPS)
Configure per-source or per-prefix rate limits at border routers. Limits are effective against simple floods but not against distributed attacks spread across thousands of sources each below the threshold.
TCP SYN Cookies
Enable tcp_syncookies=1 at the kernel level to eliminate TCP half-open connection state. Absorbs SYN floods at full line rate without dropping legitimate connections. Available in Linux, FreeBSD, and Windows Server.
L7 Challenge Pages
Issue JavaScript challenges (proof-of-work) or CAPTCHAs to distinguish browser clients from HTTP flood bots. Bots fail challenges; browsers pass. Effective for volumetric L7 floods; adds ~200–500 ms first-visit latency.
BCP38 — The Systemic Fix for Amplification
Amplification attacks rely on IP address spoofing. BCP38 (RFC 2827) mandates that ISPs drop packets at ingress whose source IP is not within the customer's allocated prefix. If universally deployed, BCP38 would eliminate the spoofing that makes amplification possible. Adoption remains incomplete: as of 2025, roughly 25% of ASNs still permit source address spoofing.
~8,500 of ~34,000 active ASNs permit spoofing = ~25%
// These ASNs are the infrastructure enabling all amplification attacks
Legal Status Worldwide
Launching a DDoS attack against any system without explicit written authorization from the owner is a criminal offense in every major jurisdiction. The penalties reflect the severity of infrastructure disruption.
| Jurisdiction | Governing law | Maximum penalty |
|---|---|---|
| United States | Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030) | Up to 10 years imprisonment per count |
| United Kingdom | Computer Misuse Act 1990 (as amended) | Up to 10 years imprisonment |
| European Union | Directive 2013/40/EU; NIS2 Directive | Varies by member state; typically 2–5 years |
| Germany | § 303b StGB (Computer sabotage) | Up to 5 years; up to 10 for critical infrastructure |
| Canada | Criminal Code § 430(1.1) | Up to 10 years imprisonment |
| Australia | Criminal Code Act 1995 (Cth) | Up to 10 years imprisonment |
Authorized testing: Penetration testers and network engineers may conduct DDoS simulation against infrastructure they own or have explicit written authorization to test. This is called load testing or stress testing and requires scope definition, risk acceptance sign-off, and notification of upstream ISPs.
Operation PowerOFF
Since 2018, Europol's Operation PowerOFF has dismantled dozens of DDoS-for-hire platforms (also called booter or stresser services). The operations resulted in arrests across the UK, Netherlands, Poland, and the US, and the seizure of server infrastructure in multiple countries. Law enforcement agencies actively monitor DDoS-for-hire marketplaces.
Frequently Asked Questions
What is a DDoS attack?
A distributed denial-of-service (DDoS) attack is a coordinated attempt to exhaust the bandwidth, connection table, or CPU resources of a target system by sending traffic from hundreds or thousands of distributed sources simultaneously, making the service unavailable to legitimate users.
What is the difference between DoS and DDoS?
A DoS (denial of service) attack originates from a single host, making it easy to block by IP address. A DDoS attack distributes the attack across thousands of sources — often a botnet — so a single firewall rule cannot stop it. DDoS attacks also commonly use IP spoofing, which DoS attacks rarely do.
How much does a DDoS attack cost the attacker?
Using open amplifiers (NTP, DNS, Memcached), an attacker needs as little as 2 Mbps of source traffic to generate 100 Gbps. Using rented botnet capacity via booter services, hourly prices for 10–50 Gbps attacks range from $10–$50. The asymmetry between attacker cost and defender cost is why DDoS remains prevalent.
What is an amplification DDoS attack?
Amplification attacks exploit UDP-based protocols that return a response much larger than the request. By spoofing the victim's IP as the source, the attacker redirects large UDP responses at the target. Memcached can amplify traffic by up to 51,000×; NTP by 556×; DNS by up to 54×. The attacker's own bandwidth requirement is therefore a tiny fraction of the attack volume.
Can you DDoS over TCP?
Direct TCP floods (SYN flood, ACK flood, RST flood) do not benefit from amplification because TCP requires a completed handshake. TCP attacks target stateful connection tables and firewalls rather than bandwidth. A SYN flood at 20 Mpps can exhaust the connection table of an unprotected server in under a millisecond; SYN cookies are the standard defense.
How is a DDoS attack mitigated?
Effective DDoS mitigation combines anycast traffic diffusion (spread attack across PoPs), BGP blackhole routing (nullroute the victim IP upstream), scrubbing centers (hardware DPI filtering), rate limiting, and L7 challenge pages for application-layer attacks. No single technique handles all attack types.
Is launching a DDoS attack illegal?
Yes. Launching a DDoS attack without explicit written authorization from the target system's owner is a criminal offense under the Computer Fraud and Abuse Act (CFAA) in the US, the Computer Misuse Act in the UK, NIS2 Directive in the EU, and equivalent laws in most jurisdictions worldwide. Penalties range from 2–10 years imprisonment.
What is a booter or stresser service?
A booter (also called a stresser) is a commercial DDoS-for-hire service that lets customers pay to launch DDoS attacks against arbitrary targets. Operating or using such services against unauthorized targets is illegal. Europol's Operation PowerOFF has seized and dismantled dozens of booter platforms since 2018, resulting in prosecutions in multiple countries.