---
title: "DDoS"
description: "A DDoS attack floods a server with traffic from thousands of hijacked devices to knock it offline. Learn attack types and how layered defense works."
url: "https://nodea.io/en/glossary/ddos"
lang: "en"
updated: "2026-07-13"
---

# DDoS

> A DDoS (Distributed Denial of Service) attack overwhelms a server, service, or network with traffic from thousands of compromised devices, blocking access for legitimate users.

A **DDoS** attack (*Distributed Denial of Service*) aims to make a website, server, or entire network unavailable to legitimate users by flooding it with traffic from many sources at once. The distribution is the point: requests come from thousands or millions of compromised devices — PCs, servers, IP cameras, home routers — herded into a botnet under the attacker's control, which makes the flood both massive and hard to filter by origin.

## How a DDoS attack works

Attacks fall into three broad classes:

- **volumetric** — saturating bandwidth with sheer packet volume, including reflection and amplification techniques where a small spoofed request to an open DNS or NTP server triggers a response many times larger, aimed at the victim;
- **protocol** — exhausting state on network gear and operating systems, the classic example being a SYN flood that fills the TCP half-open connection table;
- **application-layer (L7)** — mimicking real users while hammering computationally expensive HTTP endpoints such as search or login, which makes the traffic hard to distinguish from a genuine spike.

Modern attacks have exceeded terabits per second, and “DDoS-for-hire” services rent capacity for a few dollars — so targets include small online stores as often as large enterprises, frequently with a ransom demand attached.

## Practical applications — building a defense

Effective protection is layered. At the network edge, upstream providers and anti-DDoS services divert traffic through scrubbing centers that drop malicious packets before they reach the origin. At the application layer, a [CDN](https://nodea.io/en/glossary/cdn) or reverse proxy absorbs and disperses load geographically, while a WAF and [rate limiting](https://nodea.io/en/glossary/rate-limiting) throttle abusive request patterns. Within the infrastructure, [load balancers](https://nodea.io/en/glossary/load-balancer), capacity headroom, and hardened kernel settings raise the cost of a successful attack. When choosing a hosting or VPS provider, network-level DDoS protection is worth verifying up front — mitigation improvised mid-attack is always slower and more expensive than defenses and an incident-response contact prepared in advance.

### What is the difference between DoS and DDoS?

A DoS attack comes from a single source, which can usually be blocked by filtering one IP. A DDoS attack is distributed across a botnet of thousands of devices in many networks and countries, so source-based blocking fails and mitigation must happen at the network edge or in a dedicated scrubbing service.

## Related

- [Volumetric attack](https://nodea.io/en/glossary/volumetric-attack)
- [Firewall](https://nodea.io/en/glossary/firewall)
- [CDN (Content Delivery Network)](https://nodea.io/en/glossary/cdn)
- [Rate limiting](https://nodea.io/en/glossary/rate-limiting)
- [Load balancer](https://nodea.io/en/glossary/load-balancer)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/ddos.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)