---
title: "Volumetric attack"
description: "A volumetric attack is a DDoS variant that saturates the victim's bandwidth. Learn about amplification, reflection and how to defend against link flooding."
url: "https://nodea.io/en/glossary/volumetric-attack"
lang: "en"
updated: "2026-07-13"
---

# Volumetric attack

> A volumetric attack is a class of DDoS attack that aims to exhaust the victim's available bandwidth with a massive flood of traffic, cutting off legitimate users.

A **volumetric attack** is a form of [DDoS](https://nodea.io/en/glossary/ddos) in which the attacker sets out to exhaust the entire bandwidth of the link leading to the victim. Rather than hunting for a software flaw, the attacker simply floods the target with so many packets and bytes that legitimate traffic no longer fits on the wire — the service becomes unreachable even though the server itself is still running. The intensity of such an attack is measured in gigabits or terabits per second.

## How a volumetric attack works

The central technique is **amplification**. The attacker sends small queries to publicly exposed, misconfigured servers — DNS, NTP, memcached or CLDAP — while spoofing the victim's IP address as the source. Those servers reply with a much larger packet aimed straight at the target. This lets a botnet with modest uplink capacity generate a torrent of traffic many times its own size. Common vectors include DNS reflection, NTP amplification (the monlist request) and the exceptionally high-yield memcached reflection.

The second pillar is distribution: the flood originates from thousands of compromised devices scattered worldwide, which makes simple source-based blocking useless. The combined stream can overwhelm the capacity of even a well-provisioned data centre.

## Practical application

Defence against volumetric attacks relies on filtering traffic before it reaches the victim's infrastructure. Operators run scrubbing centres — nodes where suspicious traffic is inspected and discarded, forwarding only clean packets onward. A distributed [CDN](https://nodea.io/en/glossary/cdn) absorbs part of the blow across dozens of points of presence, and a [load balancer](https://nodea.io/en/glossary/load-balancer) spreads the residual load across many nodes. When choosing hosting or a VPS, it is worth confirming that the provider offers built-in anti-DDoS scrubbing with adequate filtering capacity. Basic hygiene helps too: closing open DNS resolvers and NTP services so your own servers never become an unwitting amplifier, and keeping [bandwidth](https://nodea.io/en/glossary/bandwidth) headroom for sudden spikes.

### How is a volumetric attack different from an application-layer attack?

A volumetric attack tries to saturate the network link with raw packets or bytes and is measured in Gb/s or Tb/s. An application-layer (Layer 7) attack sends comparatively little traffic but issues expensive requests that drain CPU or database resources. Each demands a different mitigation approach.

### Can an ordinary firewall stop a volumetric attack?

Usually not. Once the link feeding the server is already saturated, a firewall sitting at the end of that link has nothing left to protect — it drops packets too late. Effective defence filters traffic upstream, in the provider's network or a CDN, before it reaches the victim.

## Related

- [DDoS](https://nodea.io/en/glossary/ddos)
- [Firewall](https://nodea.io/en/glossary/firewall)
- [CDN (Content Delivery Network)](https://nodea.io/en/glossary/cdn)
- [Bandwidth](https://nodea.io/en/glossary/bandwidth)
- [Load balancer](https://nodea.io/en/glossary/load-balancer)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/atak-wolumetryczny.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)