DDoS Attack Types

DDoS (Distributed Denial of Service) attacks flood target systems with malicious traffic to exhaust resources and deny service to legitimate users. Attack types range from volumetric floods that consume bandwidth to application-layer attacks that target specific services, each requiring different detection and mitigation strategies.

TL;DR: DDoS attacks flood targets with traffic from distributed sources — botnets — to exhaust bandwidth (volumetric), protocol state tables, or application resources. The three main categories are volumetric (Layer 3/4), protocol/state-exhaustion (Layer 4), and application-layer attacks (Layer 7). Each requires a different mitigation strategy: scrubbing for volumetric, SYN cookies for protocol floods, and WAF + rate limiting for Layer 7.

Last updated: 2026-06-03

How DDoS Attacks Work

DDoS attacks leverage distributed sources—typically botnets of compromised devices—to generate overwhelming traffic volumes. The goal is to exhaust bandwidth, compute resources, or connection capacity, rendering the target unavailable.

┌─────────────────────────────────────────────────────────────────┐
│                    DDoS Attack Architecture                     │
│                                                                 │
│  ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐ ┌─────────┐    │
│  │ Bot 1   │ │ Bot 2   │ │ Bot 3   │ │ Bot ... │ │ Bot N   │    │
│  │ (IoT)   │ │ (Server)│ │ (PC)    │ │         │ │ (Mobile)│    │
│  └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘ └────┬────┘    │
│       │           │           │           │           │         │
│       └───────────┴───────────┼───────────┴───────────┘         │
│                               │                                 │
│                        ┌──────▼──────┐                          │
│                        │   C&C       │                          │
│                        │  Server     │                          │
│                        └──────┬──────┘                          │
│                               │ Attack command                  │
│                               ▼                                 │
│                        ┌──────────────┐                         │
│                        │    Target    │                         │
│                        │   Server     │◀─── Overwhelming traffic│
│                        │   (Victim)   │                         │
│                        └──────────────┘                         │
└─────────────────────────────────────────────────────────────────┘

DDoS Attack Classification

DDoS attacks target different layers of the OSI model, each with distinct characteristics and mitigation approaches.

1. Volumetric Attacks (Layer 3-4)

Overwhelm network bandwidth with massive traffic volumes.

UDP Flood Example:

Source: Random IPs (spoofed)
Destination: Target server
Port: Random ports
Packet size: Large UDP datagrams
Volume: 50-500 Gbps typical
Impact: Bandwidth saturation, packet loss

Amplification Attack Flow:

Attacker ──(small request)──▶ Public Server ──(large response)──▶ Victim

Example DNS Amplification:
Attacker sends: 60-byte DNS query (spoofed source = victim IP)
Server responds: 4000-byte DNS response to victim
Amplification factor: ~70x

2. Protocol Attacks (Layer 3-4)

Exploit weaknesses in network protocols to exhaust server resources.

SYN Flood Example:

Normal TCP Handshake:
Client ──SYN──▶ Server
Client ◀─SYN-ACK─ Server
Client ──ACK──▶ Server (Connection established)

SYN Flood Attack:
Attacker ──SYN──▶ Server (spoofed IP)
Server ◀─SYN-ACK─ (goes nowhere)
Attacker ──SYN──▶ Server (spoofed IP)
Server ◀─SYN-ACK─ (goes nowhere)
... (thousands more)

Result: Server's connection table fills with half-open connections
         Memory exhausted, legitimate connections fail

SYN Flood Metrics:

3. Application Layer Attacks (Layer 7)

Target specific application functions with seemingly legitimate requests.

HTTP Flood Example:

GET / HTTP/1.1
Host: target.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)...
Accept: text/html,application/xhtml+xml...

[Repeated thousands of times from distributed sources]

Slowloris Attack Flow:

Attacker opens 100+ connections to server
Sends partial HTTP headers slowly:

Connection 1: "GET / HTTP/1.1\r\nHost: target.com\r\nX-Header1: a"
Connection 2: "GET / HTTP/1.1\r\nHost: target.com\r\nX-Header1: b"
...

Every 10-15 seconds, sends additional header data to keep connection alive
Server keeps connections open waiting for complete headers
Connection pool exhausted, legitimate users cannot connect

4. Multi-Vector Attacks

Combine multiple attack types simultaneously to overwhelm defenses.

Attack Duration and Scale Statistics

Attack Frequency (2025):

• 15+ million DDoS attacks per year globally
• Average of 41,000 attacks per day
• 25% of attacks exceed 100 Gbps
• Average duration: 30 minutes
• 60% target web applications (Layer 7)

When Each Attack Type Occurs

Volumetric Attacks:

• Often used for extortion (pay to stop)
• Launched by large botnets (100K+ devices)
• Peak during business hours for maximum impact
• Common against gaming, gambling, e-commerce

Protocol Attacks:

• Target infrastructure (firewalls, load balancers)
• Exploit stateful devices with connection tracking
• Effective against unprepared network gear
• Common against enterprise infrastructure

Application Attacks:

• Target specific applications or APIs
• Lower volume but higher precision
• Harder to detect (looks like legitimate traffic)
• Common against financial services, SaaS, healthcare

Detection Methods

Volume-Based Detection

Behavioral Detection

Machine Learning Detection

Mitigation Strategies

Volumetric Attack Mitigation

Protocol Attack Mitigation

Application Attack Mitigation

Common Mistakes and Fixes

Mistake: Relying only on on-premises mitigation Fix: Use cloud-based DDoS protection for volumetric attacks that exceed your bandwidth

Mistake: No baseline traffic analysis Fix: Establish traffic baselines to detect anomalies quickly; know your normal patterns

Mistake: Mitigating only at Layer 3-4 Fix: Layer 7 attacks require application-layer defenses (WAF, rate limiting, bot detection)

Mistake: No incident response plan Fix: Document DDoS response procedures, escalation paths, and communication templates

Mistake: Manual mitigation only Fix: Implement automated detection and mitigation to respond in seconds, not minutes

Mistake: Testing mitigation only during attacks Fix: Conduct regular DDoS simulation exercises to validate defenses

DDoS Attack Quick Reference

Frequently Asked Questions

What is the difference between DDoS and DoS? DoS (Denial of Service) originates from a single source. DDoS (Distributed Denial of Service) uses multiple sources—typically thousands of compromised devices—to generate attack traffic, making it harder to block.

What is a botnet? A botnet is a network of compromised computers, IoT devices, or servers controlled by an attacker. Botnets generate DDoS traffic, send spam, or perform other malicious activities without the device owners’ knowledge.

How do amplification attacks work? Amplification attacks send small requests to public servers with spoofed source IPs (the victim’s address). The servers send large responses to the victim, amplifying the traffic 10-700x. Common amplification protocols include DNS, NTP, and SSDP.

Why are Layer 7 attacks harder to detect? Layer 7 attacks use legitimate HTTP/HTTPS requests that appear normal to network devices. They don’t require massive bandwidth, making them harder to distinguish from legitimate traffic. They target specific application functions, requiring application-aware detection.

How long do DDoS attacks typically last? Most DDoS attacks last 10-60 minutes. However, sophisticated attacks can persist for hours or days, especially extortion-driven attacks. Extended attacks require sustained mitigation capability.

Can small websites be DDoS targets? Yes. DDoS-for-hire services make attacks affordable ($5-50), so even small sites are targeted. Common motivations include extortion, competition, and ideological attacks. No site is too small to need protection.

What is the cost of DDoS downtime? DDoS downtime costs include lost revenue, productivity loss, incident response, remediation, SLA credits, and reputation damage. The final cost depends on traffic value, transaction volume, recovery time, and whether the attack disrupts revenue-generating paths such as checkout, login, or API access.

How do I distinguish a traffic spike from a DDoS attack? Traffic spikes from legitimate events (product launches, viral content) show normal request patterns. DDoS attacks show anomalous patterns: unusual source distribution, repetitive requests, known attack signatures, or protocol violations.

Should I pay a DDoS extortion demand? Law enforcement and security experts recommend against paying. Payment encourages future attacks and doesn’t guarantee the attack will stop. Instead, implement DDoS protection and report to authorities.

What is DDoS mitigation as a service? DDoS mitigation services provide cloud-based traffic scrubbing. During attacks, traffic routes through the provider’s network where malicious traffic is filtered. Clean traffic reaches your servers. Providers include cloud platforms, CDNs, and specialized security companies.

How This Applies in Practice

DDoS protection requires a layered approach:

1. Network edge: Volumetric attack detection and scrubbing
2. Infrastructure: Protocol attack mitigation (SYN cookies, connection limits)
3. Application: Layer 7 protection (WAF, rate limiting, bot detection)

Most organizations use a combination of on-premises equipment for immediate response and cloud-based services for large volumetric attacks. The key is automated detection and mitigation—attacks can overwhelm systems in seconds, leaving no time for manual intervention.

How to Implement on Azion

Azion provides integrated DDoS protection across all layers:

1. Network Layer Protection: Automatic volumetric attack mitigation at edge locations
2. Protocol Protection: SYN cookie support and connection limiting
3. Application Protection: WAF with rate limiting and bot detection for Layer 7 attacks
4. Global Distribution: Anycast network distributes attack traffic across multiple locations

Azion’s edge platform detects and mitigates DDoS attacks close to the source, protecting your origin infrastructure while maintaining availability for legitimate users.

Learn more in the Azion Documentation.

Related Resources

• What is a DDoS Attack?
• What is DDoS Protection and Mitigation?
• Application Layer Attack
• What is a Bot Attack?
• What is a Web Application Firewall?

Sources:

• CISA. “Understanding and Responding to Distributed Denial-of-Service Attacks.”
• NIST. “Guide to Intrusion Detection and Prevention Systems.” SP 800-94.
• IETF. RFC 4987: “TCP SYN Flooding Attacks and Common Mitigations.”
• NIST. “Guide to DDoS Attacks.” SP 800-83.