Skip to content
Knowledge Hub/Article
Article

What Is a DDoS Attack? Types, Botnets and Protection

A DDoS attack makes a service unreachable with traffic from many devices. We explain botnets, attack types, 2026 data and the layers of protection.

Oğuzhan Gerçek··9 min read
What Is a DDoS Attack? Types, Botnets and Protection

Short answer: A DDoS (distributed denial-of-service) attack makes a system unreachable for its legitimate users by flooding it with traffic or requests sent from many devices at once. That traffic is often generated by a botnet, a network of compromised devices that the attacker controls remotely. Attacks fall into three groups (volumetric, protocol and application-layer), and attackers can combine them. The foundation of protection is a mitigation service that absorbs traffic before it reaches the organization's link, rate limiting and a WAF at the application layer, and a response plan tested in advance.

What is a DDoS attack? How it differs from DoS

NIST's glossary defines denial of service (DoS) as the prevention of authorized access to resources or the delaying of time-critical operations; DDoS is the same technique carried out using numerous hosts. According to the joint guide published by CISA, the FBI and MS-ISAC in March 2024, a DoS attacker typically uses one computer or a small number of computers. In a DDoS attack, many sources, often tied together in a botnet, send traffic to the target at the same time. This distributed nature generates a far higher volume and makes defense harder. The impact is the same for both: service outages, financial losses and reputational damage. We summarized the three attack groups in our network security article, and there is a short definition in our glossary.

What is a botnet?

MITRE ATT&CK defines a botnet as a network of compromised systems that can be instructed to perform coordinated tasks. Attackers don't need to build their own: a ready-made network can be rented, or they can subscribe to a so-called "booter/stresser" service.

According to MITRE, internet-facing edge devices that are end-of-life and no longer supported by their manufacturers are commonly acquired for botnet activity, and networks of small office/home office (SOHO) routers or IoT devices are also leased to serve as botnets. According to Cloudflare's report for the last quarter of 2025, the Aisuru-Kimwolf botnet consists of an estimated 1 to 4 million devices, primarily Android TVs. We cover the botnet agent that lands on a device in our malware article.

Volumetric attacks: UDP floods and reflection

As CISA describes them, volumetric attacks consume the target's bandwidth or system resources with a massive volume of traffic. The simplest example is the UDP flood: according to Cloudflare, for each incoming packet the server checks whether any program is listening on the specified port, and if none is, it responds with an ICMP packet. A large enough flood can also saturate the state table of the firewall in front of the server.

Reflection is how attackers multiply volume: as MITRE explains, the attacker sends requests to third-party servers with the victim's IP address spoofed as the source, and the responses go to the victim. When protocols whose responses are larger than their requests are used, the traffic can grow by several orders of magnitude (amplification). According to MITRE, DNS and NTP are two prominent protocols here; with memcache, amplification can reach 51,200 times the requesting packet.

According to CISA, reflection traffic typically comes from legitimate public servers, so the defense has two sides: an organization's DNS resolvers should only serve devices within a trusted network, and internet providers should filter out packets with spoofed source addresses, as BCP 38 (RFC 2827) urged back in May 2000.

Protocol attacks: SYN floods

Protocol attacks, according to CISA, exploit weaknesses in network protocols or services. The classic example is the SYN flood. According to the IETF's RFC 4987 from August 2007, the attacker sends a barrage of SYN segments, often from spoofed addresses; the server keeps state for each half-open connection, and once the backlog is full, legitimate requests are rejected.

The RFC describes countermeasures along with their trade-offs: increasing the backlog, shortening the timeout, minimizing the state a SYN allocates with a SYN cache, keeping no state at all with SYN cookies, or offloading connection establishment to a firewall.

Application-layer attacks: HTTP floods and HTTP/2 Rapid Reset

Application-layer attacks consume the application's processing power. In an HTTP flood, the server is overwhelmed with GET or POST requests: as Cloudflare explains, handling a form submission and writing it to a database is resource-intensive compared with sending the request. Because this traffic is hard to tell apart from normal traffic, Cloudflare lists measures such as JavaScript challenges, CAPTCHA-like tests and a WAF.

The protocol itself can also become a weapon. Google announced that in August 2023 it had stopped HTTP/2 Rapid Reset attacks that peaked at 398 million requests per second. According to Google, the client opens many streams on a single connection and cancels each request immediately with RST_STREAM. The limit on concurrent streams is never exceeded, while the server keeps doing work for every canceled request. The vulnerability is tracked as CVE-2023-44487, and one of Cloudflare's recommendations is to patch all internet-facing web servers. That makes patch management part of DDoS defense as well.

Current scale: data from 2025 and 2026

According to Cloudflare's 2025 report, the number of DDoS attacks more than doubled in 2025, reaching 47.1 million. Four findings stand out in the first-half report covering January to June 2026, published on August 11, 2026:

  • Terabit attacks: Of the 935 network-layer attacks that exceeded 1 Tbps, 805 came in the second quarter, more than six times the previous quarter.
  • Shift to reflection: DNS-based attacks accounted for 34.3% of network-layer activity, and CLDAP floods rose 580% in a single quarter.
  • Short attacks: 96.62% of network-layer attacks stayed under 500 Mbps, and 90.60% ended in under 10 minutes.
  • Türkiye: It more than doubled its share of global attack traffic and became the third most-attacked country in the second quarter.

The report argues that manual or on-demand protection simply cannot keep up with this pace.

Ransom DDoS (RDDoS)

In Cloudflare's definition, a ransom DDoS (RDDoS) attack is an attempt to extort money with the threat of a DDoS attack. Most start with a ransom note; the attacker may carry out a small demonstration attack and set a deadline. The difference from ransomware is that it does not encrypt systems and does not require the attacker to get into internal systems. According to Cloudflare, paying the ransom is never a good idea; the threat should be reported to the appropriate law enforcement authorities.

Protecting against DDoS: the layers of defense

According to the UK's NCSC, a determined attacker will nearly always be able to send more traffic than most organizations could cope with unaided. MITRE likewise writes that floods exceeding the capacity of the targeted link typically have to be intercepted upstream: at the internet provider, at a CDN or at a DDoS mitigation provider. The layers are:

  • Scrubbing: Traffic passes through remote data centers where the malicious part is scrubbed out (Cloudflare); according to the NCSC, many internet providers may offer this.
  • CDN and anycast: According to the NCSC, it is very difficult to take down a CDN with a DoS attack, but you should make sure the CDN hides the true origin server from attackers. Anycast spreads the remaining attack traffic across multiple data centers.
  • Rate limiting: Rate limiting caps how often an action can be repeated within a given timeframe. In the NCSC's example, it stops search queries from overloading backend databases.
  • Load balancing and redundancy: CISA recommends using a load balancer to distribute traffic across multiple servers or data centers and avoid a single point of failure.
  • Monitoring: According to CISA, you need a baseline of normal traffic to spot deviations.

We cover the network side in our network protection service and the application side in our application security (WAF) service.

Response plan, testing and business continuity

DDoS is an availability incident, so its plan belongs to business continuity work. Because a response may require rapid engagement of third parties, MITRE calls for a disaster recovery or business continuity plan. According to CISA, the plan should include roles, communication channels and predefined mitigation strategies. The NCSC's recommendations are:

  1. Design the service so it keeps operating under attack, even in a degraded fashion.
  2. Provide management access over a separate network and restrict it to trusted locations.
  3. Ask your provider whether it will contact you before taking action and how long it will take to turn on additional mitigations.
  4. Test the plan periodically, and only with legitimate testing providers: as the NCSC puts it, thinking you are well prepared is not the same as knowing.
  5. During an attack, collect timestamps, IP addresses and packet captures; afterwards, update the plan with the lessons learned (CISA).

Frequently asked questions

What does DDoS mean? It stands for distributed denial of service: an attack that makes a system unreachable with traffic from many devices.

What is the difference between DoS and DDoS? A DoS attack comes from one or a few sources. A DDoS attack comes from many sources, often a botnet, so its volume is higher and it is harder to filter out.

What is a botnet? A network of compromised devices that can be controlled remotely. Botnets are used for attacks such as DDoS and large-scale phishing, and ready-made ones can be rented.

How do you protect against a DDoS attack? By combining a mitigation service that absorbs traffic before it reaches your link, a CDN, rate limiting and a WAF, backed by a response plan tested in advance.

Sources